Vulnerability

B. Braun Infusomat Space pump communication module accepts unsigned data sets from the network

MedDevice Cyber Staff · Oct 21 · 3 min read · Via CISA ICSMA-21-294-01

CISA published advisory ICSMA-21-294-01 on October 21, 2021, covering five vulnerabilities in the communication components of B. Braun's Infusomat Space Large Volume Pump. Affected are SpaceStation with SpaceCom 2 at 012U000061 and earlier and L81 and earlier, Battery Pack SP with Wi-Fi at 028U000061 and earlier and L81 and earlier, and Data module compactPlus A10. Douglas McKee and Philippe Laulheret of McAfee reported them.

The most severe is CVE-2021-33885 (CWE-345, CVSS v3 9.0). SpaceCom2 prior to 012U000062 does not verify data authenticity, so a remote unauthenticated attacker can send the device malicious data to be used in place of the correct data. CISA says the lack of cryptographic signatures on critical data sets results in full system command access and execution.

CVE-2021-33882 (CWE-306, 6.8) lets a remote attacker reconfigure the device from an unknown source, because proprietary networking commands carry no authentication. CVE-2021-33883 (CWE-319, 5.9) sends sensitive information in cleartext, including critical values for a pump's internal configuration.

CVE-2021-33886 (CWE-20, 6.8) passes a raw external string straight to printf statements, giving an unauthenticated attacker on the same network user-level command line access. CVE-2021-33884 (CWE-434, 6.5) lets remote attackers upload any file to the device's /tmp directory through the webpage API, which can overwrite critical files.

B. Braun released software updates. In the United States and Canada they are Battery pack SP with Wi-Fi 028U00093 (SN 138852 and lower) or 054U00093 (SN 138853 and higher) and SpaceStation with SpaceCom 2 012U000093. Outside the United States and Canada they are 027L000093 (below SN 138853), 053L00093 (SN 138853 and higher) and SpaceCom 2 011L000093.

Unsigned data sets on an infusion pump mean the pump will act on whatever configuration arrives over the network. Signing has to cover the data the pump acts on as well as its firmware.

Are you a representative of B. Braun? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Install B. Braun's updates: SpaceCom 2 012U000093 (United States and Canada) or 011L000093 (elsewhere), and the Battery Pack SP with Wi-Fi release that matches the unit's serial number and region. B. Braun also advises housing infusion pumps in separate firewalled or VLAN zones not reachable from the Internet. Run the pump Wi-Fi with industry standard encryption and IDS or IPS.

Update SpaceCom 2 and battery packs. Apply 012U000093 or 011L000093 to SpaceStation with SpaceCom 2 and the serial-number-matched release to each Battery Pack SP with Wi-Fi.
Zone the infusion network. Keep pumps in a separate firewalled or VLAN environment so attackers cannot reach the proprietary networking commands.
Encrypt and monitor the pump Wi-Fi. Use industry standard wireless encryption and IDS or IPS, since configuration values cross the network in cleartext on unpatched units.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Therapy delivery Web interface

SpaceStation with SpaceCom 2

PID-4111 PID-4112 PID-311 Web interface Therapy delivery

Battery Pack SP with Wi-Fi

Wireless connectivity

Fix the class in your product

The updater does not verify who it talks to or what it installs. As the maker, verify the server certificate and a cryptographic signature on the payload against a device-provisioned key before anything is written. Transport and payload signing are separate controls, and you need both.

Sign the payload. Verify a signature against a key provisioned on the device; refuse unsigned or tampered images.
Verify the server. Validate the full TLS chain and reject a mismatch rather than proceeding.
Block rollback. Refuse downgraded images so an attacker cannot force a known-vulnerable version.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2021-33885 in B. Braun SpaceCom2?

CVE-2021-33885 (CWE-345, CVSS v3 9.0) is an insufficient verification of data authenticity flaw in B. Braun SpaceCom2 prior to 012U000062, used with the Infusomat Space Large Volume Pump. A remote unauthenticated attacker can send malicious data in place of correct data, gaining full system command access because critical data sets lack cryptographic signatures. CISA disclosed it in ICSMA-21-294-01 on October 21, 2021.

Who found the B. Braun Infusomat Space vulnerabilities in ICSMA-21-294-01?

Douglas McKee and Philippe Laulheret of McAfee reported CVE-2021-33882, CVE-2021-33883, CVE-2021-33884, CVE-2021-33885 and CVE-2021-33886 in B. Braun SpaceCom2, Battery Pack SP with Wi-Fi and Data module compactPlus, per CISA advisory ICSMA-21-294-01.

How do I patch B. Braun SpaceCom 2 for CVE-2021-33885?

Update SpaceStation with SpaceCom 2 to 012U000093 in the United States and Canada or 011L000093 elsewhere, and the Battery Pack SP with Wi-Fi to the matching B. Braun release for its serial number, per CISA advisory ICSMA-21-294-01.

← Back to Vulnerabilities