Vulnerability

Abbott ICDs and CRT-Ds allow RF authentication bypass and battery drain

MedDevice Cyber Staff · Apr 17 · 4 min read · Via CISA ICSMA-18-107-01

CISA published advisory ICSMA-18-107-01 on April 17, 2018, covering two vulnerabilities in Abbott Laboratories implantable cardioverter defibrillators (ICDs) and cardiac resynchronization therapy defibrillators (CRT-Ds). MedSec Holdings Ltd is credited. The affected families are Current, Ellipse, Fortify, Fortify Assura, Promote, Promote Quadra, Quadra Assura, Quadra Assura MP, Unify, Unify Assura and Unify Quadra, distributed before April 1, 2018.

CVE-2017-12712 (CWE-287, CVSS v3 7.5) is improper authentication. The authentication algorithm, built on an authentication key and a time stamp, can be compromised or bypassed, letting a nearby attacker issue unauthorized commands over RF.

CVE-2017-12714 (CWE-920, CVSS v3 5.3) is a battery drain. The devices do not limit how many correctly formatted RF wake-up commands they accept, so a nearby attacker can keep sending them and shorten battery life.

These implants deliver high voltage pulses to correct a fast or irregular heartbeat. Both vectors require adjacent access and high attack complexity, so the attacker must be in radio range. The stakes are still a command channel into a device that shocks the heart, and a battery that cannot be swapped without surgery.

Abbott developed a firmware update that a healthcare provider applies through the Merlin PCS Programmer. Abbott and FDA recommended it for all eligible patients at the next regularly scheduled visit or when appropriate. ICDs and CRT-Ds manufactured beginning April 25, 2018, ship with the update preloaded.

The update carries its own risk. Abbott listed back-up VVI pacing discomfort, reloading of the previous firmware after an incomplete upgrade, no VT/VF treatment while in back-up mode, and loss of programmed settings or diagnostic data. Current and Promote cannot take the update at all; their only option is to permanently disable RF, which ends remote monitoring through the Merlin@home transmitter.

An implant that cannot accept a security fix leaves clinicians trading remote monitoring against radio exposure. Rate limiting on the wake-up path costs almost nothing at design time.

Are you a representative of Abbott? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Abbott's firmware update for Fortify, Fortify Assura, Quadra Assura, Quadra Assura MP, Unify, Unify Assura, Unify Quadra, Promote Quadra and Ellipse is applied by a healthcare provider through the Merlin PCS Programmer, and devices made from April 25, 2018, ship with it. Weigh the update's own risks, including back-up mode and lost settings, with the patient. Current and Promote have no patch; the only option is permanently disabling RF, which ends Merlin@home remote monitoring.

Schedule the firmware update. Apply it to eligible implants through the Merlin PCS Programmer at the next regularly scheduled visit or when appropriate.
Prepare for back-up mode. Abbott lists back-up VVI pacing and no VT/VF therapy while in back-up mode, so plan the session accordingly.
Decide RF for Current and Promote. These devices cannot be updated; permanently disabling RF removes the exposure but also remote monitoring, which Abbott calls inadvisable for most patients.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Therapy delivery Field-updatable firmware Remote access Home use

ICD and CRT-D high voltage device families

PID-27 PID-332 Wireless connectivity Therapy delivery Field-updatable firmware Remote access Home use

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2017-12712 in Abbott implantable defibrillators?

CVE-2017-12712 (CWE-287, CVSS v3 7.5) is an authentication bypass in Abbott ICDs and CRT-Ds distributed before April 1, 2018: the authentication algorithm can be compromised or bypassed, letting a nearby attacker issue unauthorized RF commands. CISA published advisory ICSMA-18-107-01 on April 17, 2018; Abbott released a firmware update applied via the Merlin PCS Programmer.

Can Abbott Current and Promote defibrillators get the cybersecurity firmware update?

No. Per CISA advisory ICSMA-18-107-01, Abbott's older Current and Promote devices cannot accept the firmware update for CVE-2017-12712 and CVE-2017-12714 due to technology limitations. Providers can permanently disable RF communication, but the patient then loses remote monitoring through the RF Merlin@home transmitter.

Which Abbott ICD and CRT-D families receive the April 2018 firmware update?

The firmware update in CISA advisory ICSMA-18-107-01 covers Fortify, Fortify Assura, Quadra Assura, Quadra Assura MP, Unify, Unify Assura, Unify Quadra, Promote Quadra and Ellipse. Devices manufactured beginning April 25, 2018, have it preloaded.

← Back to Vulnerabilities