Vulnerability

Abbott Accent, Anthem, Assurity and Allure pacemakers get firmware fix for RF authentication bypass

MedDevice Cyber Staff · Aug 29 · 3 min read · Via CISA ICSMA-17-241-01

CISA published advisory ICSMA-17-241-01 on August 29, 2017, covering three vulnerabilities in four Abbott Laboratories pacemaker families: Accent/Anthem, Accent MRI, Assurity/Allure and Assurity MRI. The advisory lists firmware before the August 28 update as affected.

CVE-2017-12712 (CWE-287, CVSS v3 7.5) is the serious one. The pacemaker's authentication algorithm uses an authentication key and a time stamp, and it can be compromised or bypassed. A nearby attacker could then issue unauthorized commands to the implant over RF.

CVE-2017-12714 (CWE-920, CVSS 5.3) lets the same nearby attacker send correctly formatted RF wake-up commands without limit, draining the battery. CVE-2017-12716 (CWE-311, CVSS 3.1) applies to Accent and Anthem only. Those models transmit patient information unencrypted over RF to programmers and home monitoring units, and they store optional patient information without encryption. Assurity and Allure encrypt stored patient information and do not carry that flaw.

The fix is a firmware update that implements RF wake-up protections, limits the commands that can be issued over RF and, on Accent and Anthem, stops unencrypted transmission of patient information. A healthcare provider applies it to the implanted pacemaker through the Merlin PCS Programmer.

The advisory recommends that providers discuss the update with patients and weigh the risk of a cybersecurity attack against the risk of performing a firmware update. Implants force that trade-off, because applying a patch means a clinical procedure on a device the patient depends on every second.

Rate limits on RF wake-up commands belong in the first firmware release of any implant with a radio.

Are you a representative of Abbott? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Abbott's pacemaker firmware update through the Merlin PCS Programmer during a patient visit. It adds RF wake-up protections, limits RF commands, and stops unencrypted transmission of patient information on Accent and Anthem. Providers should discuss the update with each patient and weigh the attack risk against the risk of performing a firmware update.

Identify affected implants. List patients with Accent/Anthem, Accent MRI, Assurity/Allure or Assurity MRI pacemakers running firmware older than the August 28 update.
Discuss the update with each patient. Weigh the risk of a cybersecurity attack against the risk of performing a firmware update, as the advisory recommends.
Apply the firmware with the Merlin PCS Programmer. A healthcare provider installs the update on the implanted pacemaker during an office visit.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Therapy delivery Field-updatable firmware Handles patient data

Accent and Anthem pacemakers

PID-4112 PID-3322 PID-27 Wireless connectivity Handles patient data Field-updatable firmware

Assurity and Allure pacemakers

PID-3322 PID-27 Wireless connectivity Field-updatable firmware

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Flexiva Pulse Laser Fiber	Boston Scientific	Same signals	No feedback feed from manufacturer
Zenition 90	Philips	Same signals	No feedback feed from manufacturer
Accu-Chek Solo micropump system with interoperable technology	Roche	Same signals	No feedback feed from manufacturer

Questions & Answers

How is the Abbott Assurity pacemaker RF vulnerability CVE-2017-12712 fixed?

Abbott released a pacemaker firmware update, covered in CISA advisory ICSMA-17-241-01 on August 29, 2017, that implements RF wake-up protections and limits the commands that can be issued over RF for the Accent/Anthem, Accent MRI, Assurity/Allure and Assurity MRI families. A healthcare provider applies it to the implanted pacemaker using the Merlin PCS Programmer.

Do Abbott Accent and Anthem pacemakers send patient data unencrypted?

Yes. Per CISA advisory ICSMA-17-241-01, Accent and Anthem pacemakers transmit patient information unencrypted over RF to programmers and home monitoring units (CVE-2017-12716, CVSS v3 3.1). The firmware update applied through the Merlin PCS Programmer stops the unencrypted transmission. Assurity and Allure are not affected by this flaw.

Can an attacker drain the battery of an Abbott pacemaker?

CVE-2017-12714 (CVSS v3 5.3) in Abbott Accent, Anthem, Assurity and Allure pacemakers lets a nearby attacker repeatedly send correctly formatted RF wake-up commands to reduce battery life, according to CISA advisory ICSMA-17-241-01 of August 29, 2017. The firmware update adds RF wake-up protections.

← Back to Vulnerabilities