Siemens Healthineers Security Advisories

WORKAROUNDS AND MITIGATIONS 

Siemens Healthineers has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:

• The web services should never be exposed to the Internet (except Web Portal layer)
• Access to the application server should be limited to only those nodes that require syngo Dynamics functionality

Product-specific remediations or mitigations can be found in the section Affected Products and Solution.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

In addition, Siemens Healthineers recommends the following:

• Ensure you have appropriate backups and system restoration procedures.
• Securely delete any backup files that are no longer needed.
• For specific patch and remediation guidance information contact your local Siemens Healthineers Customer Service Engineer, portal or our Regional Support Center. To find your local contact, please refer to https://www.siemens-healthineers.com/en-us/how-can-we-help-you

PRODUCT DESCRIPTION

syngo Dynamics Cardiovascular Imaging and Information System (CVIS) is used for the acceptance,
transfer, display, storage, archive and manipulation of digital medical images, as well as quantification
and report generation. syngo Dynamics also provides the ability to manage patient information, order
entry, workflow management and business analytics.

VULNERABILITY CLASSIFICATION

The vulnerability classification has been performed by using the CVSS scoring system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS environmental score is specific to the customer’s environment and will impact the overall CVSS score. The environmental score should therefore be individually defined by the customer to accomplish final scoring.
An additional classification has been performed using the CWE classification, a community-developed list of common software security weaknesses. This serves as a common language and as a baseline for weakness identification, mitigation, and prevention efforts. A detailed list of CWE classes can be found at: https://cwe.mitre.org/.

Vulnerability CVE-2022-42732
syngo Dynamics application server hosts a web service using an operation with improper read access
control that could allow files to be retrieved from any folder accessible to the account assigned to the
website’s application pool.
CVSS v3.1 Base Score 7.5
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CWE CWE-73: External Control of File Name or Path

Vulnerability CVE-2022-42733
syngo Dynamics application server hosts a web service using an operation with improper read access
control that could allow files to be retrieved from any folder accessible to the account assigned to the
website’s application pool.
CVSS v3.1 Base Score 7.5
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CWE CWE-73: External Control of File Name or Path

Vulnerability CVE-2022-42734
syngo Dynamics application server hosts a web service using an operation with improper write access
control that could allow to write data in any folder accessible to the account assigned to the website’s
application pool.
CVSS v3.1 Base Score 9.1
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
CWE CWE-73: External Control of File Name or Path

Vulnerability CVE-2022-42891
syngo Dynamics application server hosts a web service using an operation with improper write access
control that could allow to write data in any folder accessible to the account assigned to the website’s
application pool.
CVSS v3.1 Base Score 9.1
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
CWE CWE-73: External Control of File Name or Path

Vulnerability CVE-2022-42892
syngo Dynamics application server hosts a web service using an operation with improper write access
control that could allow directory listing in any folder accessible to the account assigned to the website’s
application pool.
CVSS v3.1 Base Score 9.1
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
CWE CWE-23: Relative Path Traversal

Vulnerability CVE-2022-42893
syngo Dynamics application server hosts a web service using an operation with improper write access
control that could allow to write data in any folder accessible to the account assigned to the website’s
application pool.
CVSS v3.1 Base Score 9.1
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
CWE CWE-73: External Control of File Name or Path

Vulnerability CVE-2022-42894
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability was identified in one of the
web services exposed on the syngo Dynamics application that could allow for the leaking of NTLM
credentials as well as local service enumeration.
CVSS v3.1 Base Score 5.3
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
CWE CWE-918: Server-Side Request Forgery (SSRF)

ACKNOWLEDGMENTS 

Siemens Healthineers thanks the following parties for their efforts:

• Ryan Wincey from Securifera, Inc. for coordinated disclosure

ADDITIONAL INFORMATION 

syngo Dynamics VA20 and older versions are past End of Support.

For further inquiries on security vulnerabilities in Siemens Healthineers products and solutions, please contact Siemens Healthineers using the following link: https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity

HISTORY DATA 

V1.0 (2022-11-17): Publication Date

TERMS OF USE

Siemens Healthineers Security Advisories are subject to the terms and conditions contained in Siemens’ Healthineers underlying license terms or other applicable agreements previously agreed to with Siemens Healthineers (hereinafter "License Terms"). To the extent applicable to information, software or docu- mentation made available in or through a Siemens Healthineers Security Advisory, the Terms of Use of Siemens’ Healthineers Global Website (https://www.siemens-healthineers.com/en-us/terms-of-use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.