Vulnerability

B. Braun SpaceStation with SpaceCom module has an open redirect in its web server

MedDevice Cyber Staff · Mar 23 · 2 min read · Via CISA ICSMA-17-082-02

CISA published advisory ICSMA-17-082-02 on March 23, 2017, for an open redirect in B. Braun's SpaceStation with the SpaceCom module. The flaw is tracked as CVE-2017-6018 (CWE-601) with a CVSS v3 base score of 5.4. Two configurations are listed: SpaceStation part number 8713140U with an installed SpaceCom module (part number 8713160U), and SpaceStation with SpaceCom integrated as part number 8713142U, both on software earlier than 012U000040.

Per the advisory, the web server accepts untrusted input that can redirect a request to an unintended URL carried inside that input. An open redirect lets an attacker build a link that starts at the trusted device address and lands somewhere else, which is the setup step for phishing a clinical user or a biomed technician into a fake login page.

The vector requires user interaction (UI:R) and gives only low confidentiality and integrity impact, so this is a medium finding on its own. It still says something about how the embedded web server treats parameters. B. Braun's mitigation in the advisory is a pointer to its software distribution site at ftp.bbmus.com.

Any parameter that controls a redirect on a device web server should be checked against an allowlist of internal paths. Free-form URLs in that slot are a standing invitation.

Are you a representative of B. Braun? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update SpaceStation units with the SpaceCom module to software 012U000040 or later, using B. Braun's distribution site referenced in ICSMA-17-082-02. Until then, keep the SpaceCom web interface reachable only from the clinical device network. Treat links that point at the device address with the same suspicion as any external link.

Inventory SpaceCom versions. Find every SpaceStation with a SpaceCom module (part numbers 8713160U or 8713142U) and record its software version against 012U000040.
Apply the B. Braun update. Install software 012U000040 or later from the distribution site B. Braun named in the advisory.
Restrict web access. Limit the SpaceCom web server to the biomed and clinical subnets that need it, so crafted links from outside cannot reach it.
Allowlist redirect targets in design. Redirect parameters on embedded web servers should accept only internal relative paths, never arbitrary URLs.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface

Contributing

Hospital network

SpaceStation with SpaceCom module

PID-311 Web interface

Fix the class in your product

Field input is reflected into a WebView without encoding, so input becomes script in the app context. As the maker, context-encode every value before it renders, set a strict content security policy, and prefer native rendering for sensitive data.

Encode at every sink. Render user data with textContent or an auto-escaping template, never innerHTML.
Set a strict CSP. Block inline and injected script as a second layer.
Prefer native rendering. Keep PHI out of a WebView where a missed encode becomes code.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novum IQ Large Volume Pump	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Aperio GT 450 DX	Leica Biosystems	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aetherSlide	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer

12 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2017-6018 in the B. Braun SpaceStation SpaceCom module?

CVE-2017-6018 is an open redirect (CWE-601, CVSS v3 5.4) in the web server of B. Braun SpaceStation units with the SpaceCom module (part numbers 8713140U with 8713160U, and 8713142U) running software earlier than 012U000040. CISA disclosed it in advisory ICSMA-17-082-02 on March 23, 2017.

How do I fix the B. Braun SpaceCom open redirect vulnerability?

CISA advisory ICSMA-17-082-02 lists SpaceCom software earlier than 012U000040 as affected by CVE-2017-6018 and refers users to B. Braun's download site at ftp.bbmus.com for the update.

← Back to Vulnerabilities