New Vulnerabilities Reported in Baxter’s Internet-Connected Infusion Pumps

A number of security vulnerabilities have been disclosed in Baxter’s internet-linked infusion pumps utilised by health care pros in scientific environments to dispense medication to patients.

“Productive exploitation of these vulnerabilities could outcome in accessibility to sensitive knowledge and alteration of program configuration,” the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported in a coordinated advisory.

Infusion pumps are internet-enabled products made use of by hospitals to provide medicine and nourishment right into a patient’s circulatory procedure.

The 4 vulnerabilities in problem, identified by cybersecurity firm Rapid7 and claimed to Baxter in April 2022, influence the next Sigma Spectrum Infusion devices –

• Sigma Spectrum v6.x product 35700BAX
• Sigma Spectrum v8.x model 35700BAX2
• Baxter Spectrum IQ (v9.x) model 35700BAX3
• Sigma Spectrum LVP v6.x Wireless Battery Modules v16, v16D38, v17, v17D19, v20D29 to v20D32, and v22D24 to v22D28
• Sigma Spectrum LVP v8.x Wi-fi Battery Modules v17, v17D19, v20D29 to v20D32, and v22D24 to v22D28
• Baxter Spectrum IQ LVP (v9.x) with Wi-fi Battery Modules v22D19 to v22D28

The record of flaws uncovered is underneath –

• CVE-2022-26390 (CVSS score: 4.2) – Storage of network credentials and affected individual wellbeing data (PHI) in unencrypted structure
• CVE-2022-26392 (CVSS score: 2.1) – A format string vulnerability when running a Telnet session
• CVE-2022-26393 (CVSS score: 5.) – A format string vulnerability when processing Wi-Fi SSID info, and
• CVE-2022-26394 (CVSS score: 5.5) – Lacking mutual authentication with the gateway server host

Productive exploitation of the higher than vulnerabilities could cause a distant denial-of-services (DoS), or empower an attacker with physical obtain to the product to extract delicate data or alternatively have out adversary-in-the-middle attacks.

The vulnerabilities could even more final result in a “decline of critical Wi-Fi password information, which could lead to better network accessibility must the network not be thoroughly segmented,” Deral Heiland, principal security researcher for IoT at Speedy7, informed The Hacker Information.

Baxter, in an advisory, emphasised that the issues only affect customers who use the wireless capabilities of the Spectrum Infusion Method, but also cautioned it could guide to a hold off or interruption of treatment need to the flaws be weaponized.

“If exploited, the vulnerabilities could result in disruption of [Wireless Battery Module] operation, disconnection of the WBM from the wireless network, alteration of the WBM’s configuration, or publicity of information saved on the WBM,” the firm claimed.

The hottest conclusions are nevertheless a further indication of how common software package vulnerabilities continue on to plague the professional medical industry, a concerning enhancement supplied their likely implications affecting individual care.

That reported, this is not the very first time security flaws in infusion pumps have come beneath the scanner. Earlier this March, Palo Alto Networks Unit 42 disclosed that an too much to handle bulk of infusion pumps were being uncovered to virtually 40 identified vulnerabilities, highlighting the need to have to protected health care units from security threats.

Baxter is recommending customers to ensure that all knowledge and configurations are erased from decommissioned pumps, spot infusion units at the rear of a firewall, enforce network segmentation, and use sturdy wi-fi network security protocols to prevent unauthorized obtain.

It can be very important to “put into practice processes and techniques to control the de-acquisition of professional medical technology, [and] to guarantee that PII and/or configuration data such as Wi-Fi, WPA, PSK, etcetera., are purged from the gadgets prior to resale or transfer to a further party,” Heiland explained.

“Sustain sturdy actual physical security inside and all over health-related locations that contains MedTech gadgets, as well as places with accessibility to a biomed network. Apply network segmentation for all biomed networks to avert other common or small business networks from communicating with MedTech equipment.”

Found this short article interesting? Stick to THN on Fb, Twitter  and LinkedIn to study far more exclusive information we submit.

Some parts of this write-up are sourced from:
thehackernews.com