Vulnerability

B. Braun Battery Pack SP with Wi-Fi web server eval injection gives root on the pump module

MedDevice Cyber Staff · Apr 13 · 2 min read · Via CISA ICSMA-23-103-01

CISA published advisory ICSMA-23-103-01 on April 13, 2023, for CVE-2023-0888 in the B. Braun Battery Pack SP with Wi-Fi. Affected software is 053L000091 (global) and 054U000091 (U.S.), and 053L000092 (global) and 054U000092 (U.S.). Tom Johnston reported it.

The weakness is eval injection (CWE-95) in the Wi-Fi battery's embedded web server, versions L90/U70 and L92/U92, with a CVSS v3 base score of 5.5. An authenticated user with access to both the medical device Wi-Fi network and the battery pack's web server credentials, such as a biomedical engineering staff member, could gain root access on the infusion pump communication module. CISA notes that access could be used to launch further attacks.

The infusion pumps themselves are not directly affected. B. Braun says interrupted network communication might stop certain features from working, so an impacted device may be unable to receive infusion orders from EMR/PDMS systems, receive a drug library update, or communicate with DoseTrac.

B. Braun released software updates and documented them in its vulnerability advisory. Facilities in Canada running U versions follow the U.S. release; those on L versions follow the global one.

The high-privilege precondition keeps the score moderate, and it also means the battery pack's web server credentials deserve the protection of a root password.

Are you a representative of B. Braun? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Install the software update B. Braun released for the Battery Pack SP with Wi-Fi, using the U.S. or global version that matches the unit. Exploitation needs both medical device Wi-Fi access and the battery pack web server credentials, so restrict and rotate those credentials. Keep the pump Wi-Fi segmented from general networks.

Apply B. Braun's update. Follow the B. Braun vulnerability advisory to replace 053L000091/054U000091 and 053L000092/054U000092 software.
Lock down web server credentials. Limit the battery pack web server credentials to the biomedical staff who need them and change them when staff leave.
Segment the medical device Wi-Fi. Keep the pump wireless network reachable only by authorized devices and staff.
Watch infusion order delivery. Investigate any pump that stops receiving EMR/PDMS orders or drug library updates.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface Wireless connectivity

Contributing

User accounts HL7 or FHIR integration Therapy delivery

Battery Pack SP with Wi-Fi

PID-311 PID-3321 Web interface Wireless connectivity HL7 or FHIR integration User accounts

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2023-0888 in the B. Braun Battery Pack SP with Wi-Fi?

CVE-2023-0888 (CWE-95, CVSS v3 5.5) is an eval injection flaw in the embedded web server of the B. Braun Battery Pack SP with Wi-Fi, software 053L000091/054U000091 and 053L000092/054U000092. An authenticated user with Wi-Fi network access and web server credentials could gain root on the infusion pump communication module. CISA disclosed it in ICSMA-23-103-01 on April 13, 2023.

Does CVE-2023-0888 affect B. Braun infusion pumps directly?

No. B. Braun says the infusion pumps are not directly affected by CVE-2023-0888, but interrupted network communication from the Battery Pack SP with Wi-Fi could stop a device receiving EMR/PDMS infusion orders or drug library updates, or communicating with DoseTrac, per CISA advisory ICSMA-23-103-01.

← Back to Vulnerabilities

Key Facts

Target Product: Battery Pack SP with Wi-Fi 053L000091 (global) / 054U000091 (U.S.); 053L000092 (global) / 054U000092 (U.S.) (B. Braun Melsungen AG)
Device Type: Infusion pump wireless battery module
Material: Battery Pack SP with Wi-Fi embedded web server = L90/U70 and L92/U92
Components: Web Application, Wireless Module, Battery
Interfaces: WiFi, TCP
Dataflows: EMR/PDMS to Infusion Pump (infusion orders); Drug library update source to Infusion Pump (drug library update); Infusion Pump to DoseTrac; Biomedical engineering workstation to Battery Pack web server over Wi-Fi
Assets: battery pack web server credentials (Credentials); drug library update (Software Update); B. Braun software updates for Battery Pack SP with Wi-Fi (Software Update)
Advisory: ICSMA-23-103-01
CVE: CVE-2023-0888
CVSS: 5.5 (v3)
Severity: Medium
Disclosed: Apr 13, 2023
Source: CISA ICSMA-23-103-01

Sources

B. Braun: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: B. Braun