Vulnerabilities allow attackers to take over infusion pumps
Two vulnerabilities in Windows CE-powered Alaris Gateway Workstations (AWGs), which provide support for widely used infusion pumps, could allow remote attackers to disable the device, install malware, report false information, and even instruct the pumps to alter drug dosages and infusion rates.
About Alaris Gateway Workstations
Developed by US-based medical device maker Becton, Dickinson and Company (BD), Alaris Gateway Workstations are deployed in healthcare establishments in Europe and Asia.
A company spokesperson told TechCrunch that it is used in about 50 countries and that none of them has more than 3,000 devices deployed.
AWGs are used to provide mounting, power, and communication support to infusion and syringe pumps, which are used in a wide range of therapies: fluid therapy, blood transfusions, chemotherapy, dialysis, anesthesia, etc.
About the vulnerabilities
The vulnerabilities were identified by Elad Luz, Head of Research at CyberMDX. Their existence was confirmed by the manufacturer.
CVE-2019-10959 is found in the workstation’s firmware and may allow an attacker to upload malicious files during a firmware update.
“In order to access this vulnerability, an attacker would need to gain access to a hospital network, have intimate knowledge of the product, be able to update and manipulate a CAB file, which stores files in an archived library and utilizes a proper format for Windows CE. If an attacker is able to complete those steps, they may also utilize this vulnerability to change the scope to adjust commands on the infusion pump, including adjust the infusion rate on specific mounted infusion pumps,” Becton Dickinson explained.
“In addition to the steps above, to exploit the vulnerability on the Workstation, an attacker would need to create an executable with custom code that can run in the Windows CE environment, understand how the internal communication protocols are utilized within the product and create a specific installer for the CAB file, with settings required to run the program. Adjusting the change in scope is difficult to exploit.”
The attacker could also brick the machine, plant a malicious agent as a base for network attack, and report false status from the pumps.
“Because of the ease of attack, the remote nature and the high impact, the firmware vulnerability was given a severity score of 10 out of 10,” CyberMDX noted.
CVE-2019-10962 affects the workstations’ web management console, which requires no credentials for access.
“As a result, anyone knowing the IP address of a targeted workstation can monitor pump statuses, access event logs, and user guide; change the gateway’s network configuration (IP/subnet/WiFi/LAN); and restart the gateway,” CyberMDX explained.
Again, the attacker must first access the hospital network in order to mount the attack, but given the widespread outdatedness of many computer systems used by healthcare organizations that should not be a huge problem.
“This vulnerability does not have a direct impact on any mounted infusion pump functionality or performance as this is a web-based application utilized for only the aggregation of data,” BD pointed out.
Closing the holes and mitigating the risk of exploitation
CVE-2019-10959 affects AWGs with the following firmware versions: 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14 and 1.3.1 Build 13.
It can also be found in older BD products with software version 2.3.6: Alaris GS, Alaris GH, Alaris CC and Alaris TIVA – pumps that were previously sold under the Asena brand.
BD advises administrators to upgrade to firmware versions 1.3.2 or 1.6.1, to block the SMB protocol, segregate their VLAN network and ensure that only appropriate associates have access to the network.
“BD has created a remediation which removes accessibility to the SMB network share. Further details, including implementation of the remediation, will be provided within 60 days of this original update,” the company added.
CVE-2019-10962 affects AWGs with the firmware versions 1.0.13, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.1.5 and 1.1.6.
BD advises administrators to upgrade to firmware versions 1.3.2 or 1.6.1, to make sure that only appropriate associates have access to the network, and to isolate their network from untrusted systems.
Additional general mitigations can be found here.