Vulnerability

Baxter flags ExactaMix EM2400 v1.10/v1.11 and EM1200 v1.1/1.2 for BlueKeep RDP flaw

MedDevice Cyber Staff · May 16 · 3 min read · Via Baxter ExactaMix CVE-2019-0708 bulletin

Baxter published a product security bulletin on May 16, 2019 on CVE-2019-0708, the Remote Desktop Services remote code execution vulnerability Microsoft disclosed. It lists ExactaMix (EM2400) v1.10/v1.11 and ExactaMix (EM1200) v1.1/1.2 as running on an operating system that Microsoft determined to be susceptible. The bulletin reached version 2.0 on August 8, 2019.

The flaw affects Remote Desktop Services on Windows XP, Windows 7, Windows Server 2003 and Windows Server 2008. An unauthenticated attacker who connects over RDP and sends specially crafted requests can run code, and Microsoft released patches for all affected systems, including those out of support.

Baxter says the compounders are designed with security controls that do not allow users to connect remotely to the product using RDP. It still recommends upgrading to ExactaMix EM1200 v1.4 and EM2400 v1.13, which run Windows 10 and are not susceptible. It also asks customers to patch customer-owned Windows machines, including the ExactaMix file share and order management hosts, follow the ExactaMix Cybersecurity Guide and block port 3389 at the firewall.

Baxter had received no reports of the vulnerability impacting clinical use. The file share and order management machines around a compounder are the easier targets, and they are the customer's to patch.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade ExactaMix EM1200 to v1.4 and EM2400 to v1.13, the Windows 10 builds Baxter says are not susceptible to CVE-2019-0708. Until then, keep port 3389 blocked and apply Microsoft's patch to every customer-owned Windows machine that serves the compounder.

Schedule the ExactaMix upgrade. Move EM1200 units to v1.4 and EM2400 units to v1.13 through Baxter technical support.
Block RDP. Ensure the network firewall blocks port 3389 traffic to and from the compounders.
Patch the surrounding hosts. Apply Microsoft's CVE-2019-0708 update to the ExactaMix file share and the machines running order management software.
Segment per the guide. Follow the segmentation recommendations in the ExactaMix Cybersecurity Guide from Baxter product security.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Contributing

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Baxter ExactaMix versions are affected by BlueKeep CVE-2019-0708?

Baxter's May 16, 2019 bulletin lists ExactaMix (EM2400) v1.10/v1.11 and ExactaMix (EM1200) v1.1/1.2 as running on an operating system susceptible to CVE-2019-0708, the Remote Desktop Services remote code execution vulnerability.

How do I fix CVE-2019-0708 on a Baxter ExactaMix compounder?

Baxter recommends upgrading to ExactaMix EM1200 v1.4 or EM2400 v1.13, which run Windows 10 and are not susceptible to CVE-2019-0708, plus patching customer-owned Windows machines around the compounder and blocking port 3389.

Can BlueKeep be exploited remotely on Baxter ExactaMix?

Baxter says ExactaMix compounders are designed with security controls that do not allow users to connect remotely using RDP, which reduces exposure to CVE-2019-0708. It still recommended an upgrade in its May 16, 2019 bulletin.

← Back to Vulnerabilities