Vulnerability

BD Alaris 8000 PC unit stores wireless network credentials unencrypted in flash memory

MedDevice Cyber Staff · Jan 17 · 2 min read · Via CISA ICSMA-17-017-01

CISA published advisory ICSMA-17-017-01 on January 17, 2017, covering one vulnerability in the Becton, Dickinson and Company (BD) Alaris 8000 PC unit. All versions are affected. CVE-2016-8375 is insufficiently protected credentials (CWE-522) with a CVSS v3 base score of 4.9.

The PC unit stores wireless network authentication credentials and other sensitive technical data on internal flash memory, without encryption. An attacker who takes a unit apart and reads that flash with special tools can pull the credentials out. The CVSS vector reflects the effort: physical access, high attack complexity, high confidentiality impact and a changed scope.

The changed scope is what matters to a hospital. A secret recovered from one unit opens the wireless network it joins, so the impact lands on everything else that network carries. CISA notes that carrying out the attack inside a healthcare facility would raise the odds of detection, which pushes the realistic threat toward units that leave the building for repair, resale or disposal.

BD released a security bulletin for the Alaris PC unit model 8000, which the advisory lists as the mitigation; no fixed firmware version is named. Any device that leaves the hospital carrying a network key should be treated as a leaked credential until that key is rotated.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

CISA advisory ICSMA-17-017-01 names no fixed firmware version; BD points customers to its security bulletin for the Alaris PC unit model 8000. Every unit holds the wireless network credentials in unencrypted flash, so any unit that leaves hospital custody exposes the network key. Keep units under physical control and rotate the credentials when one goes missing or is retired.

Pull the BD bulletin. Get BD's security bulletin for the Alaris PC unit model 8000 and apply the mitigations it lists for CVE-2016-8375.
Control physical custody. Track Alaris 8000 PC units through repair, loan and disposal so no unit leaves with credentials nobody accounts for.
Rotate the key after a loss. Change the wireless network authentication credentials whenever a unit is lost, stolen or decommissioned with its flash intact.
Segment the device wireless network. Give these units their own wireless network so a recovered credential reaches only that segment.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Hospital network

Alaris 8000 PC unit

PID-12 Wireless connectivity

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Versana Essential	GE HealthCare	Same signals	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
Infinity CentralStation Wide	Dräger	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
Versana Premier	GE HealthCare	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
Optomed Smartscope M5 with Optomed Smartscope FA	Optomed	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Zenition 70	Philips	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Zenition 90	Philips	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer

Questions & Answers

What is CVE-2016-8375 in the BD Alaris 8000 PC unit?

CVE-2016-8375 is an insufficiently protected credentials flaw (CWE-522, CVSS v3 4.9) in all versions of the BD Alaris 8000 PC unit. The unit stores wireless network authentication credentials unencrypted on internal flash memory, and an attacker with physical access who disassembles it can extract them. CISA disclosed it in advisory ICSMA-17-017-01 on January 17, 2017.

Is there a fix for the BD Alaris 8000 PC unit wireless credential exposure?

CISA advisory ICSMA-17-017-01, published January 17, 2017, points to a BD security bulletin for the Alaris PC unit model 8000 as the mitigation for CVE-2016-8375 and names no fixed firmware version. Hospitals limit the exposure by keeping units under physical control and rotating the wireless network key when a unit leaves their custody.

← Back to Vulnerabilities