A number of safety vulnerabilities have been disclosed in Baxter’s internet-connected infusion pumps utilized by healthcare professionals in medical environments to dispense medicine to sufferers.
“Profitable exploitation of those vulnerabilities might lead to entry to delicate information and alteration of system configuration,” the U.S. Cybersecurity and Infrastructure Safety Company (CISA) stated in a coordinated advisory.
Infusion pumps are internet-enabled gadgets utilized by hospitals to ship medicine and diet immediately right into a affected person’s circulatory system.
The 4 vulnerabilities in query, found by cybersecurity agency Rapid7 and reported to Baxter in April 2022, have an effect on the next Sigma Spectrum Infusion methods –
- Sigma Spectrum v6.x mannequin 35700BAX
- Sigma Spectrum v8.x mannequin 35700BAX2
- Baxter Spectrum IQ (v9.x) mannequin 35700BAX3
- Sigma Spectrum LVP v6.x Wi-fi Battery Modules v16, v16D38, v17, v17D19, v20D29 to v20D32, and v22D24 to v22D28
- Sigma Spectrum LVP v8.x Wi-fi Battery Modules v17, v17D19, v20D29 to v20D32, and v22D24 to v22D28
- Baxter Spectrum IQ LVP (v9.x) with Wi-fi Battery Modules v22D19 to v22D28
The listing of flaws uncovered is under –
- CVE-2022-26390 (CVSS rating: 4.2) – Storage of community credentials and affected person well being info (PHI) in unencrypted format
- CVE-2022-26392 (CVSS rating: 2.1) – A format string vulnerability when operating a Telnet session
- CVE-2022-26393 (CVSS rating: 5.0) – A format string vulnerability when processing Wi-Fi SSID info, and
- CVE-2022-26394 (CVSS rating: 5.5) – Lacking mutual authentication with the gateway server host
Profitable exploitation of the above vulnerabilities might trigger a distant denial-of-service (DoS), or allow an attacker with bodily entry to the gadget to extract delicate info or alternatively perform adversary-in-the-middle assaults.
The vulnerabilities might additional lead to a “lack of crucial Wi-Fi password information, which might result in better community entry ought to the community not be correctly segmented,” Deral Heiland, principal safety researcher for IoT at Rapid7, informed The Hacker Information.
Baxter, in an advisory, emphasised that the problems solely have an effect on prospects who use the wi-fi capabilities of the Spectrum Infusion System, but additionally cautioned it might result in a delay or interruption of remedy ought to the issues be weaponized.
“If exploited, the vulnerabilities might lead to disruption of [Wireless Battery Module] operation, disconnection of the WBM from the wi-fi community, alteration of the WBM’s configuration, or publicity of information saved on the WBM,” the corporate stated.
The most recent findings are yet one more indication of how widespread software program vulnerabilities proceed to plague the medical business, a regarding improvement given their potential implications affecting affected person care.
That stated, this isn’t the primary time safety flaws in infusion pumps have come underneath the scanner. Earlier this March, Palo Alto Networks Unit 42 disclosed that an awesome majority of infusion pumps have been uncovered to almost 40 recognized vulnerabilities, highlighting the necessity to safe healthcare methods from safety threats.
Baxter is recommending prospects to make sure that all information and settings are erased from decommissioned pumps, place infusion methods behind a firewall, implement community segmentation, and use robust wi-fi community safety protocols to stop unauthorized entry.
It is essential to “implement processes and procedures to handle the de-acquisition of medical expertise, [and] to guarantee that PII and/or configuration information akin to Wi-Fi, WPA, PSK, and many others., are purged from the gadgets previous to resale or switch to a different get together,” Heiland stated.
“Keep robust bodily safety inside and round medical areas containing MedTech gadgets, in addition to areas with entry to a biomed community. Implement community segmentation for all biomed networks to stop different normal or enterprise networks from speaking with MedTech gadgets.”
