Vulnerability

Baxter ExactaMix compounders carry hard-coded admin credentials and send orders in clear text

MedDevice Cyber Staff · Jun 18 · 4 min read · Via CISA ICSMA-20-170-01

CISA published advisory ICSMA-20-170-01 on June 18, 2020, covering seven vulnerabilities in Baxter ExactaMix compounders. Affected are the EM1200 at versions 1.1, 1.2, 1.4 and 1.5 and the EM2400 at versions 1.10, 1.11, 1.13 and 1.14, with each flaw hitting a different subset. Baxter reported the issues.

Two flaws are hard-coded administrative credentials. CVE-2020-12016 (CWE-259, CVSS 8.1) covers the ExactaMix operating system on every listed version and lets an attacker with network access view sensitive data including PHI. CVE-2020-12012 (CVSS 6.8) is a second hard-coded admin account in the ExactaMix application, reachable with physical access.

The oldest builds (EM2400 1.10 and 1.11, EM1200 1.1 and 1.2) add three more. CVE-2020-12008 (CWE-319, CVSS 7.5) is cleartext messages carrying order information to the order entry system. CVE-2020-12032 (CWE-311, CVSS 8.1) is device data with sensitive information stored in an unencrypted database. CVE-2017-0143 (CVSS 8.1) is the SMBv1 input validation flaw from Microsoft bulletin MS17-010, which can lead to remote code execution.

The physical side rounds it out. CVE-2020-12024 (CWE-284, CVSS 6.8) is an unrestricted USB interface that lets someone at the machine load a payload or reach the hard drive by booting a live USB OS. CVE-2020-12020 (CWE-668, CVSS 6.1) lets non-administrative users reach the operating system and edit the application startup script.

Baxter recommends that users of EM2400 1.10 and 1.11 and EM1200 1.1 and 1.2 contact service support to upgrade to version 1.13 (EM2400) or 1.4 (EM1200), and that all users apply compensating controls. It also offers an ExactaMix Cybersecurity Guide on request. The hard-coded OS credentials still appear on 1.13, 1.14, 1.4 and 1.5, so the upgrade narrows the list without closing it.

A compounder that still answers on SMBv1 belongs on an isolated segment with nothing else.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade ExactaMix EM2400 1.10 and 1.11 to 1.13 and EM1200 1.1 and 1.2 to 1.4 through Baxter service support; that removes the cleartext, unencrypted database and SMBv1 issues. The hard-coded OS credentials and USB exposure remain on current versions, so every site needs Baxter's compensating controls and network isolation. Request the ExactaMix Cybersecurity Guide from Baxter.

Upgrade the oldest builds. Move EM2400 1.10 and 1.11 to 1.13 and EM1200 1.1 and 1.2 to 1.4 via Baxter service support.
Isolate the compounders. Hard-coded OS credentials remain on current versions, so restrict network access to the order entry system only.
Control the USB ports. Keep compounders in a locked pharmacy space so nobody can boot a live USB OS on them.
Generate credentials per device. Device makers should replace shared admin accounts with unique credentials set at installation.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

USB port Patient or study database Handles patient data

ExactaMix

PID-3321 PID-4112 PID-14 PID-41 User accounts Patient or study database USB port Handles patient data

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What vulnerabilities affect the Baxter ExactaMix EM1200 and EM2400?

CISA advisory ICSMA-20-170-01 of June 18, 2020 lists seven: hard-coded OS and application admin credentials (CVE-2020-12016, CVE-2020-12012), cleartext order messages (CVE-2020-12008), an unencrypted database (CVE-2020-12032), an unrestricted USB interface (CVE-2020-12024), editable startup scripts (CVE-2020-12020) and SMBv1 flaw CVE-2017-0143.

Which Baxter ExactaMix versions should be upgraded?

Baxter recommends that ExactaMix EM2400 versions 1.10 and 1.11 move to version 1.13, and EM1200 versions 1.1 and 1.2 move to version 1.4, through Baxter service support, per CISA advisory ICSMA-20-170-01. All users should also apply Baxter's compensating controls.

Does the Baxter ExactaMix hard-coded password CVE-2020-12016 expose PHI?

Yes. Per CISA advisory ICSMA-20-170-01, CVE-2020-12016 (CVSS 8.1) is hard-coded administrative credentials for the ExactaMix operating system on EM2400 1.10 to 1.14 and EM1200 1.1 to 1.5, which could let an attacker with network access view sensitive data including PHI.

← Back to Vulnerabilities