Regarding Vulnerability in the BlackBerry QNX Real Time Operating System
Versions 6.5 SP1 and Earlier

The vulnerability issue that affects BlackBerry QNX Real Time Operating System versions 6.5 SPI and earlier, and its impact on Canon Medical Systems Products, is explained below.


1. What is the vulnerability issue that affects BlackBerry QNX versions 6.5 SP1 and earlier?
On Tuesday, August 17, 2021, the Cybersecurity & Infrastructure Security Agency (CISA) issued an alert about a vulnerability that affects versions 6.5 SP1 and earlier of BlackBerry’s QNX Real Time Operating System (QNX).

The scope of use of QNX includes the medical field, and if this vulnerability is exploited, systems may become unusable. Data theft, data leakage, and device hijacking may also occur. Therefore, in Japan, the National center of Incident readiness and Strategy for Cybersecurity (NISC) issued a warning about this vulnerability on Wednesday, August 18, 2021.

2. Results of a risk assessment of the vulnerability issue that affects BlackBerry QNX versions 6.5 SP1 and earlier.
The evaluation result of a CVSS (Common Vulnerability Scoring System) risk assessment was 9.8. The degree of impact on confidentiality, integrity, and availability were all assessed as “high”.

3. Impact on Canon Medical Systems Products
Canon Medical Systems Products using BlackBerry QNX versions 6.5 SP1 and earlier are as follows:

（１）X-ray CT systems
System Model
Aquilion ONE TSX-301A
TSX-301C/1,2,3,4,5
Aquilion TSX-301B
Aquilion PRIME TSX-302A
TSX-303A/1,2,3,4,5,6,7,8,9,K
Aquilion CX TSX-101A/H,I,J,K,N
Aquilion CXL TSX-101A/Q,S,T


（２）MRI Systems
System Model
Vantage AGV/XGV/ZGV MRT-1503, MRT-2003
Vantage ATLAS-X/Z MRT-1503, MRT-2003
Vantage Titan MRT-1504, MRT-1510, MRT-2004
Vantage Titan MRT-1510
Vantage Orian MRT-1550
Vantage Elan MRT-2020
Vantage Titan 3T MRT-3010
Vantage Galan 3T MRT-3020
Vantage Centurian MRT-3020


4. Canon Medical Systems’ response to the vulnerability issue that affects BlackBerry QNX versions 6.5 SP1 and earlier.
In all of the systems listed in Section 3, QNX is only used for internal units and is not connected to an external network. Therefore, we have confirmed that there are no risks associated with this vulnerability that affect Canon Medical Systems Products.
For any inquiries from customers regarding this matter, such as information about which systems are affected, please contact your nearest branch office or sales office. For the contact information of the branch offices and sales offices in each region, please refer to the “Global Network (Countries and Regions)” page below. https://global.medical.canon/about/global/