Vulnerability

B. Braun SpaceCom and Battery Pack SP with Wi-Fi carry 11 flaws from XSS to unsigned firmware

MedDevice Cyber Staff · Oct 22 · 4 min read · Via CISA ICSMA-20-296-02

CISA published advisory ICSMA-20-296-02 on October 22, 2020, covering 11 vulnerabilities in B. Braun's infusion communication devices: SpaceCom and the Battery Pack SP with Wi-Fi at L81/U61 and earlier, and the Data module compactplus at A10 and A11. Julian Suleder, Nils Emmerich and Birk Kauer of ERNW Research GmbH and Dr. Oliver Matula of ERNW Enno Rey Netzwerke GmbH reported them.

The administrative web interface carries the highest scores. CVE-2020-25158 is reflected cross-site scripting (CVSS v3 7.6), CVE-2020-25162 is XPath injection that lets unauthenticated remote attackers read sensitive information and escalate privileges (7.5), and CVE-2020-25150 is relative path traversal (7.6) that lets a user with service privileges upload a crafted tar file and execute arbitrary commands. Session fixation (CVE-2020-25152, 6.5) and an open redirect (CVE-2020-25154, 5.4) complete the web findings.

Deeper in the device, CVE-2020-25166 (CVSS 6.8) is improper verification of the cryptographic signature of firmware updates, which lets attackers generate valid updates with arbitrary content. CVE-2020-16238 (6.7) lets a user with command line access escalate to root on the underlying Linux system through the configuration import mechanism. CVE-2020-25156 (7.2) is active debug code that gives root to an attacker holding the right cryptographic material.

Three more cover credentials and configuration. CVE-2020-25164 (CWE-759, 5.1) lets attackers recover administrative interface credentials hashed without a salt, CVE-2020-25168 (3.3) is hard-coded credentials that open the Wi-Fi module to anyone with command line access, and CVE-2020-25160 (6.8) is improper access control that lets attackers extract and tamper with the network configuration.

CISA's risk evaluation reads the set as a chain: privilege escalation, exposure of sensitive information, arbitrary file upload and remote code execution on the Space and compactplus communication devices.

B. Braun released software updates. In the United States and Canada they are Battery pack SP with Wi-Fi software 028U00093 (SN 138852 and lower) and 054U00093 (SN 138853 and higher), and SpaceStation with SpaceCom 2 software 012U000093. Outside the United States and Canada they are Battery Pack SP with Wi-Fi 027L000093 (below SN 138853) and 053L00093 (SN 138853 and higher), and SpaceCom 2 version 011L000093.

A communication module that accepts forged firmware and ships debug code is a second computer attached to the pump. It deserves the same threat model as the pump.

Are you a representative of B. Braun? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update to B. Braun's fixed software: in the United States and Canada, Battery pack SP with Wi-Fi 028U00093 or 054U00093 depending on serial number and SpaceCom 2 012U000093; elsewhere 027L000093, 053L00093 and SpaceCom 2 011L000093. B. Braun also advises a network zone concept that keeps infusion pumps in separate firewalled or VLAN environments. Wireless networks carrying them should use industry standard encryption and IDS or IPS.

Install the fixed software. Match each Battery Pack SP with Wi-Fi to its serial number range and region before choosing the update, and update SpaceCom 2 alongside it.
Zone the pump network. Keep infusion pumps and their communication modules in a separate firewalled or VLAN environment that is unreachable from the Internet.
Harden the pump Wi-Fi. Use industry standard encryption on the wireless network and put IDS or IPS on it.
Restrict service accounts. Limit who holds service user credentials, since the path traversal upload needs service privileges.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface

Contributing

Wireless connectivity Field-updatable firmware Named operating system User accounts

SpaceCom

PID-311 PID-27 PID-23 PID-3321 Web interface Named operating system Field-updatable firmware User accounts

Battery Pack SP with Wi-Fi

Wireless connectivity

Data module compactplus

PID-311 Web interface

Fix the class in your product

The server accepts an uploaded file and lets it execute. As the maker, validate type by content, store uploads under a server-generated name in a non-executable location outside the web root, and serve them back through a handler that never interprets them.

Validate by content. Check magic bytes, not the extension; cap size and scan on ingest.
Store inert and non-executable. Server-generated name, no-exec directory, outside the web root.
Never execute an upload. Serve through a handler that returns bytes, never interprets them.

Mapped EMB3D mitigations

Questions & Answers

What vulnerabilities did CISA report in B. Braun SpaceCom in ICSMA-20-296-02?

CISA advisory ICSMA-20-296-02, published October 22, 2020, lists 11 vulnerabilities in B. Braun SpaceCom and Battery Pack SP with Wi-Fi at L81/U61 and earlier and Data module compactplus A10 and A11, including XSS (CVE-2020-25158), XPath injection (CVE-2020-25162), path traversal file upload (CVE-2020-25150) and firmware signature verification failure (CVE-2020-25166).

Which software versions fix the B. Braun Battery Pack SP with Wi-Fi vulnerabilities?

In the United States and Canada, B. Braun's fixes are Battery pack SP with Wi-Fi software 028U00093 (SN 138852 and lower) or 054U00093 (SN 138853 and higher) and SpaceCom 2 software 012U000093. Elsewhere they are 027L000093, 053L00093 and SpaceCom 2 version 011L000093, per CISA advisory ICSMA-20-296-02.

Can B. Braun SpaceCom accept forged firmware updates?

Yes, in affected versions. CVE-2020-25166 is an improper verification of the cryptographic signature of firmware updates in B. Braun SpaceCom L81/U61 and earlier and Data module compactplus A10 and A11, letting attackers generate valid firmware updates with arbitrary content. B. Braun released fixed software, per CISA advisory ICSMA-20-296-02.

← Back to Vulnerabilities