Vulnerability

Baxter Phoenix hemodialysis system sends treatment and prescription data in cleartext

MedDevice Cyber Staff · Jun 18 · 2 min read · Via CISA ICSMA-20-170-03

CISA published advisory ICSMA-20-170-03 (Update A) on June 18, 2020, for a cleartext transmission vulnerability in the Baxter Phoenix Hemodialysis Delivery System, versions 3.36 and 3.40. CVE-2020-12048 (CWE-319) carries a CVSS v3 base score of 7.5. Baxter reported it.

The Phoenix does not support data-in-transit encryption such as TLS when it sends treatment and prescription data to the Exalis dialysis data management tool. Anyone with access to that network segment can read the traffic. The vector is network, low complexity, no privileges, with the impact limited to confidentiality.

CISA's risk statement is narrow: an attacker with unauthorized network access could view sensitive data. Nothing in the advisory says the link can be used to alter a treatment. Prescription data in the clear is still PHI in the clear, and the same missing encryption on a link that carries settings would be a far worse finding.

Baxter's answer is implementation guidance and a product security bulletin, plus a reminder that users must assess the risks of integrating the device into an enterprise network and repeat that analysis when the network changes. Unencrypted device-to-server links belong on a segment where the only listener is the server.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The advisory points to Baxter implementation guidance and its Product Security Bulletin for Phoenix versions 3.36 and 3.40 rather than an encrypted release. Keep the Phoenix and the Exalis tool on an isolated segment so the cleartext traffic cannot be observed, and reassess that design whenever the enterprise network changes.

Isolate Phoenix to Exalis traffic. Put the dialysis systems and the Exalis server on a dedicated segment or VLAN with no other listeners.
Follow Baxter's implementation guidance. Apply the configuration in the Baxter Product Security Bulletin for the Phoenix system.
Re-run the risk analysis after network changes. Baxter states that changes to the enterprise network can introduce new risks that need fresh analysis.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Hospital network

Contributing

Handles patient data Therapy delivery

Phoenix Hemodialysis Delivery System

PID-4112 Therapy delivery Handles patient data Hospital network

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
CARESCAPE B450, E-musb	GE HealthCare	Same signals	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
ProBeam 360 Proton Therapy System v3.0	Varian	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer

Questions & Answers

What is CVE-2020-12048 in the Baxter Phoenix Hemodialysis Delivery System?

CVE-2020-12048 (CWE-319, CVSS v3 7.5) means the Baxter Phoenix Hemodialysis Delivery System versions 3.36 and 3.40 send treatment and prescription data to the Exalis dialysis data management tool without data-in-transit encryption. CISA covered it in advisory ICSMA-20-170-03 on June 18, 2020.

Is there a patch for the Baxter Phoenix cleartext vulnerability?

CISA advisory ICSMA-20-170-03 lists Baxter implementation guidance and a Baxter Product Security Bulletin for CVE-2020-12048 in Phoenix versions 3.36 and 3.40, with users told to control the risks of connecting the device to an enterprise network.

← Back to Vulnerabilities