Compounding software that did not encrypt its database traffic by default

MedDevice Cyber Staff · May 15 · 2 min read · Via Baxter Product Security

Baxter published a bulletin on Abacus, its compounding and pharmacy software. The finding: Abacus supports encrypted client-server communication with the SQL database, but transport encryption is not on by default in legacy configurations, so traffic can travel in the clear, open to interception or tampering.

Encryption that ships supported but disabled is a recurring compromise in long-lived clinical software. When a product must interoperate with older installations, turning strong transport on by default risks breaking a site that was configured long ago, so the choice that is safe for compatibility becomes the unsafe one for security. The setting then sits in a configuration file a busy pharmacy operation has no reason to revisit.

Cleartext database traffic creates exposure in more than a single direction. An attacker on the network segment can read what passes, which on a pharmacy system is patient and preparation detail, and can also alter it in transit, which is the graver problem. The records that describe how a medication was compounded are the kind a later step trusts without rechecking, so tampering that never trips an alarm can propagate into what a patient actually receives.

The capability was there. The default was off. That gap between supported and enabled is where a lot of real-world exposure lives, and on software that calculates and records medication preparation, traffic an attacker can read or alter is a safety concern, not just a privacy one. The remediation is to enable TLS 1.2 or higher. Make encrypted the default, because most operators never change one.

Baxter surfaced the weakness in its own product bulletin, the quiet form of disclosure a maker uses when the correction is a configuration change rather than an emergency patch. The broader signal is about defaults. A generation of clinical systems was deployed when the internal hospital network was treated as trusted ground, and the slow reckoning since has been the industry discovering how many of those defaults left sensitive links unprotected.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Abacus supports encrypted client-server communication but did not turn it on by default in legacy configurations, leaving database traffic in the clear. Enable transport encryption on every deployment and confirm no legacy install is still passing SQL unprotected.

Turn encryption on. Enable the transport encryption Abacus already supports across every client-server link, per the Baxter bulletin.
Audit legacy deployments. Find installs that predate the setting and confirm each now negotiates encryption rather than falling back to cleartext.
Make encryption the default. Ship secure-by-default so an operator does not have to know to enable protection that already exists.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

app_database data_phi

Contributing

net_wired net_remote_access app_user_accounts use_hospital_net sys_ots_software

EMB3D

PID-3322 PID-4112 PID-4113

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Questions & Answers

What did Baxter disclose about Abacus?

The compounding and pharmacy software supports encrypted client-server communication with its SQL database, but transport encryption was not enabled by default in legacy configurations, leaving traffic open to interception or tampering.

What is the remediation for Abacus installations?

Enable TLS 1.2 or higher. On software that calculates and records medication preparation, readable or alterable traffic is a safety concern, not just a privacy one.

← Back to Vulnerabilities