Vulnerability

Baxter PrismaFlex and PrisMax send treatment data to EMR systems without encryption or authentication

MedDevice Cyber Staff · Jun 18 · 3 min read · Via CISA ICSMA-20-170-02

CISA published advisory ICSMA-20-170-02 on June 18, 2020, later revised as Update B, covering three vulnerabilities in Baxter PrismaFlex (all versions) and PrisMax (versions before 3.x). Baxter reported the issues itself.

CVE-2020-12036 (CWE-319, CVSS v3 6.5) concerns the data path to hospital systems. The devices do not implement data-in-transit encryption such as TLS when configured to send treatment data to a Patient Data Management System (PDMS) or an Electronic Medical Record (EMR) system, so an attacker on the network can observe that data.

CVE-2020-12035 (CWE-287, CVSS v3 7.6) carries the higher score. The same connection requires no authentication, which could let an attacker modify treatment status information. CVE-2020-12037 (CWE-259, CVSS v3 5.4) is a hard-coded service password on PrismaFlex that opens biomedical information, device settings, calibration settings and network configuration to anyone with physical access, who could then change settings and calibration.

Baxter's own recommendations add a clinical angle. A PDMS or EMR system that is not compatible with PrismaFlex and PrisMax can present erroneous data, so the integration has to be verified and its risks analyzed, and later changes to the enterprise network can introduce new risks.

For PrisMax, Baxter recommends upgrading to PrisMax v3 with the Digital Communication Module (DCM), which supports a mutually authenticated TLS tunnel to a PDMS or EMR system capable of TLS 1.2. PrismaFlex software 8.2x adds the option to set a device-specific service password, though 8.2x is not available in all regions, including the United States.

Unauthenticated writes into a clinical record are an integrity problem before they are a privacy problem.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade PrisMax to v3 with the Digital Communication Module, which supports a mutually authenticated TLS 1.2 tunnel to the PDMS or EMR system. PrismaFlex has no complete fix: software 8.2x adds a device-specific service password but is not available in the United States. Verify PDMS and EMR compatibility and keep the devices on a segmented network.

Upgrade PrisMax to v3 with DCM. The Digital Communication Module brings a mutually authenticated TLS tunnel to the PDMS or EMR system.
Set a device-specific service password. Where PrismaFlex software 8.2x is available, replace the shared service password.
Verify the PDMS or EMR integration. Baxter warns that an incompatible system can present erroneous data, so validate the pairing and reassess after network changes.
Segment the treatment data path. Restrict the connection between the devices and the PDMS or EMR to known hosts so traffic cannot be read or altered in transit.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Hospital network

Contributing

Therapy delivery User accounts

PrisMax

PID-4112 PID-331 Hospital network

PrismaFlex

PID-4112 PID-331 PID-3321 Hospital network User accounts

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Central Station	Nihon Kohden	Same signals	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-328	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-328	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
LOGIQ e	GE HealthCare	Exposed to the same EMB3D threatTID-328	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
da Vinci SP Surgical System	Intuitive	Exposed to the same EMB3D threatTID-328	No feedback feed from manufacturer
CT Collaboration Live	Philips	Exposed to the same EMB3D threatTID-328	No feedback feed from manufacturer
Image Management V15	Philips	Exposed to the same EMB3D threatTID-328	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-328	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-328	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer

2 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

Is there a fix for CVE-2020-12035 in Baxter PrisMax?

Yes. Baxter recommends upgrading to PrisMax v3 with the Digital Communication Module (DCM), which supports a mutually authenticated TLS tunnel to a PDMS or EMR system capable of TLS 1.2. CISA advisory ICSMA-20-170-02, published June 18, 2020, lists PrisMax versions before 3.x as affected by CVE-2020-12035 (CVSS v3 7.6) and CVE-2020-12036 (CVSS v3 6.5).

What does the hard-coded password in Baxter PrismaFlex expose?

CVE-2020-12037 (CVSS v3 5.4) is a hard-coded service password in all versions of Baxter PrismaFlex that provides access to biomedical information, device settings, calibration settings and network configuration, per CISA advisory ICSMA-20-170-02 of June 18, 2020. PrismaFlex software 8.2x adds a device-specific service password but is not available in all regions, including the United States.

← Back to Vulnerabilities

Key Facts

Product 1: PrisMax Before 3.x (Baxter)
Device Type: Treatment device with EMR interface
Product 2: PrismaFlex All versions (Baxter)
Device Type: Treatment device with EMR interface
Materials: TLS 1.2; PrismaFlex software all versions, fixed in 8.2x
Components: Generic Application, Generic Hardware
Interfaces: TCP, TLS
Dataflows: PrismaFlex/PrisMax to PDMS/EMR system (treatment data, unencrypted and unauthenticated); PrisMax v3 DCM to PDMS/EMR system over mutually authenticated TLS
Assets: treatment data sent to PDMS/EMR (Patient Data); hard-coded service password (PrismaFlex) (Credentials); calibration settings (Calibration Data); device settings and network configuration (Software Configuration)
Advisory: ICSMA-20-170-02
CVEs: CVE-2020-12035, CVE-2020-12036, CVE-2020-12037
CVSS: 7.6 (v3)
Severity: High
Disclosed: Jun 18, 2020
Source: CISA ICSMA-20-170-02

Sources

Baxter: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: Baxter