Vulnerability

Baxter Welch Allyn Connex Spot Monitor used a default cryptographic key

MedDevice Cyber Staff · May 30 · 2 min read · Via CISA ICSMA-24-151-02

CISA published advisory ICSMA-24-151-02 on May 30, 2024, covering CVE-2024-1275 in the Baxter Welch Allyn Connex Spot Monitor (CSM), versions 1.52 and prior. Maarten Boone and Edwin Van Andel of Zerocopter reported it.

The monitor uses a default cryptographic key for potentially critical functionality (CWE-1394, CVSS v3 7.4). An attacker who knows the key could modify device configuration and firmware data, and Baxter said tampering with that data could compromise the device and affect or delay patient care.

The fix predates the advisory. Version 1.52.01 has been available since October 16, 2023. Baxter recommends upgrading through its product security page and applying proper network and physical security controls.

A key shared by every unit off the line is a key every researcher with one unit already has, which is why each device needs its own.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade every Welch Allyn Connex Spot Monitor to version 1.52.01, available since October 16, 2023. Until all units are updated, apply network and physical security controls and check monitor configurations for unexpected changes.

Install 1.52.01. Update every Connex Spot Monitor at 1.52 or earlier.
Check configurations. Compare monitor settings against your approved baseline for unexpected changes.
Apply network and physical controls. Restrict who can reach the monitors on the network and in person.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Field-updatable firmware

Contributing

Hospital network Wireless connectivity

Welch Allyn Connex Spot Monitor (CSM)

PID-4113 Field-updatable firmware

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
ProBeam 360 Proton Therapy System v3.0	Varian	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Same signals	No feedback feed from manufacturer
Aptima HCV Quant Dx Assay	Hologic	Same signals	No feedback feed from manufacturer
MONARCH Platform	Johnson & Johnson MedTech	Same signals	No feedback feed from manufacturer
Electrosurgical Generator ESG-400	Olympus	Same signals	No feedback feed from manufacturer
DigitalDiagnost	Philips	Same signals	No feedback feed from manufacturer
SYSTEM 1E Liquid Chemical Sterilant Processing System	STERIS	Same signals	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer

2 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2024-1275 in the Welch Allyn Connex Spot Monitor?

CVE-2024-1275 (CWE-1394, CVSS v3 7.4) is the use of a default cryptographic key in the Baxter Welch Allyn Connex Spot Monitor 1.52 and prior, which could let an attacker modify device configuration and firmware data. CISA published it as ICSMA-24-151-02 on May 30, 2024.

Which Connex Spot Monitor version fixes CVE-2024-1275?

Baxter fixed CVE-2024-1275 in Welch Allyn Connex Spot Monitor version 1.52.01, available since October 16, 2023, according to CISA advisory ICSMA-24-151-02 from May 30, 2024.

← Back to Vulnerabilities