Vulnerability

Baxter Welch Allyn Configuration Tool put entered credentials at risk

MedDevice Cyber Staff · May 30 · 2 min read · Via CISA ICSMA-24-151-01

CISA published advisory ICSMA-24-151-01 on May 30, 2024, covering CVE-2024-5176 in the Baxter Welch Allyn Product Configuration Tool, versions 1.9.4.1 and prior. Baxter disclosed it.

The weakness is insufficiently protected credentials (CWE-522, CVSS v3 9.6). The advisory's instruction is blunt: any credentials used for authentication or entered while using the tool may be compromised and should be changed immediately. Baxter said it had found no evidence of any compromise of personal or health data.

Baxter removed the tool from public access. Customers who need configuration files now go through Baxter Technical Support at (800) 535-6663, option 2, or their Baxter project manager. Version 1.9.4.2 was due in Q3 2024 and needs no user action once released.

Configuration tools collect Wi-Fi keys and directory accounts by design, so a leak there reaches far past the tool itself.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Change every credential that was used or entered in the Welch Allyn Product Configuration Tool 1.9.4.1 or earlier, now. The tool is no longer public; request configuration files from Baxter Technical Support until version 1.9.4.2 ships.

Rotate entered credentials. Change every password, network key and account that anyone typed into the tool.
Stop using old copies. Retire local installs of version 1.9.4.1 or earlier and request configuration files from Baxter.
Apply network and physical controls. Limit who can reach configured devices while the new version is pending.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Wireless connectivity Hospital network

Welch Allyn Product Configuration Tool

PID-332 User accounts

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2024-5176 in the Welch Allyn Configuration Tool?

CVE-2024-5176 (CWE-522, CVSS v3 9.6) is an insufficiently protected credentials flaw in the Baxter Welch Allyn Product Configuration Tool 1.9.4.1 and prior. Any credentials used or entered in the tool may be compromised and should be changed. CISA published it as ICSMA-24-151-01 on May 30, 2024.

When is the Welch Allyn Configuration Tool fix available?

Baxter planned Welch Allyn Product Configuration Tool version 1.9.4.2 for Q3 2024 and removed the tool from public access in the meantime, per CISA advisory ICSMA-24-151-01 from May 30, 2024.

← Back to Vulnerabilities