Vulnerability

BD Alaris 8015 PC unit exposes stored Wi-Fi credentials on its removable flash card

MedDevice Cyber Staff · Jan 17 · 3 min read · Via CISA ICSMA-17-017-02

CISA published advisory ICSMA-17-017-02 (Update B) on January 17, 2017, covering two vulnerabilities in the Becton, Dickinson and Company (BD) Alaris 8015 PC unit, the point-of-care controller of the Alaris infusion system. The listed versions are 9.5 and prior, 9.33 and prior, and 9.7. CISA credits Dan Regalado, Asher Davila Loranca and Ryan Dion of Palo Alto.

CVE-2016-8375 (CWE-522, CVSS v3 4.9) lets an attacker with physical access remove the external Wi-Fi card and connect a pre-programmed malicious CompactFlash card to pull unencrypted wireless network authentication credentials. CVE-2016-9355 (CWE-284, CVSS v3 6.8) goes after the removable flash memory itself. An attacker who disassembles the unit gets read and write access to device memory and can overwrite application and internal data, including logs and the drug library.

The bigger exposure sits outside the pump. Software 9.5 and earlier keeps the hospital's wireless authentication credentials on that removable card, so one stolen or borrowed PC unit hands an attacker the keys to the clinical Wi-Fi network. CISA's own risk note frames the impact as access to the host facility's wireless network credentials.

BD has not developed a product fix. It issued compensating controls and a security bulletin for the 8015, and states that all Alaris System software versions below 9.19 are end of life. BD recommends upgrading when its next software version clears 510(k).

A credential stored in the clear on removable media is a facility credential, and it should be rotated and scoped as if every pump in storage could leak it.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no product fix for the Alaris 8015 PC unit flaws. Apply BD's compensating controls from its 8015 security bulletin, control physical access to PC units, and treat the wireless credentials stored on version 9.5 and earlier as exposed. Plan migration off Alaris System software below 9.19, which BD lists as end of life.

Rotate the infusion Wi-Fi credentials. Assume any credential stored on a version 9.5 or earlier CompactFlash card is recoverable and change it, scoping it to the infusion network only.
Lock down physical custody of PC units. Track units in storage, repair and transport, since both attacks need hands on the device.
Apply BD's compensating controls. Follow the BD security bulletin for the Alaris PC unit model 8015 and contact BD Customer Support for details.
Schedule the software upgrade. Retire versions below 9.19 and move to BD's next cleared Alaris System release.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Removable media

Contributing

Wireless connectivity Therapy delivery Hospital network

Alaris 8015 PC unit

PID-123 Removable media Wireless connectivity Therapy delivery

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2016-8375 in the BD Alaris 8015 PC unit?

CVE-2016-8375 (CVSS v3 4.9) lets an attacker with physical access to a BD Alaris 8015 PC unit swap the Wi-Fi card for a malicious CompactFlash card and obtain unencrypted wireless network credentials. CISA covered it in advisory ICSMA-17-017-02 on January 17, 2017.

Is there a patch for the BD Alaris 8015 PC unit removable flash vulnerability CVE-2016-9355?

No. BD has not developed a product fix for CVE-2016-9355 or CVE-2016-8375 in the Alaris 8015 PC unit and instead issued compensating controls, per CISA advisory ICSMA-17-017-02. BD says Alaris System software below 9.19 is end of life and recommends upgrading when its next version clears 510(k).

← Back to Vulnerabilities