A 10.0 SQL injection on a patient health portal

MedDevice Cyber Staff · Sep 5 · 2 min read · Via CISA

The Baxter Connex Health Portal, formerly Hillrom and Welch Allyn, drew ICSMA-24-249-01. CVE-2024-6795, unauthenticated SQL injection, base score 10.0, plus CVE-2024-6796, an access-control flaw at 8.2.

SQL injection persists for a structural reason. When an application builds a query by pasting user input into the command text, the database cannot separate the developer's intent from the attacker's addition, and a string typed into a form becomes an instruction the server carries out. The unauthenticated form is the worst shape of the flaw, because the entry point sits in front of the login rather than behind it.

A maximum-severity SQL injection means a remote attacker with no credentials runs arbitrary SQL: read, alter or delete data, and admin actions like shutting down the database. On a patient health portal that is every record it holds. Baxter deployed a server-side fix, the one advantage of a hosted portal over shipped software, since the maker patches it once for everyone.

A health portal is built to be reached. It faces the public network by design so patients and clinicians can sign in from outside the hospital, which is what makes an unauthenticated flaw so serious. The same door that serves legitimate users serves the attacker, and behind it sits a database holding identifiers, contact details and clinical information in a single queryable place.

This is the second near-maximum SQL injection in this archive, alongside the Siemens imaging platform. The oldest web vulnerability in the book still lands critical findings on medical software. Parameterize every query.

The hosted model shaped the response as much as the flaw shaped the risk. Because the portal runs on infrastructure the maker controls, a single fix reaches every user at once, without the long tail of updates that shipped software drags behind it. That advantage runs both ways, since centralized services close quickly when the maker is attentive and concentrate sensitive data behind whatever the weakest query happens to be.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The Baxter Connex Health Portal had a critical unauthenticated SQL injection at base score 10.0 (ICSMA-24-249-01), letting a remote attacker run arbitrary SQL, plus an access-control flaw exposing patient and clinician data. Apply the fix, parameterize queries, and enforce authorization on every record.

Apply the vendor fix. Update the Connex Health Portal to the remediated version from ICSMA-24-249-01.
Parameterize every query. An unauthenticated 10.0 SQL injection means input reached the database unescaped; use parameterized statements everywhere.
Enforce authorization per record. Check on the server that the caller may see each patient or clinician record, closing the access-control gap.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

app_database data_phi

Contributing

net_cloud app_web_ui app_user_accounts net_remote_access app_roles use_hospital_net

EMB3D

PID-311

Fix the class in your product

Input reaches the database as query text. As the maker, parameterize every query so input is never concatenated into SQL, run on a least-privilege database account, and enforce it with a static-analysis gate so a concatenated query fails the build.

Parameterize every query. No exceptions for internal or trusted callers; bind inputs, never build statement text from them.
Least-privilege the database role. The app account cannot alter schema or reach unrelated tables.
Gate it in CI/CD. Static analysis fails a build that concatenates a query.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2024-6795 in the Baxter Connex Health Portal?

An unauthenticated SQL injection rated a maximum 10.0 under ICSMA-24-249-01. A remote attacker with no credentials could run arbitrary SQL against the portal database, alongside CVE-2024-6796, an access control flaw rated 8.2.

Do customers need to patch the Connex Health Portal?

No. The portal is hosted, so Baxter deployed a server-side fix that covers every customer at once with no local action required.

What data was at risk in the Connex portal?

Patient and clinician data held by the portal. A 10.0 SQL injection allows reading, altering or deleting database contents, and the companion access control flaw exposed records directly.

← Back to Vulnerabilities