Vulnerability

BD Alaris 8015 PC Unit and Systems Manager session authentication flaw can knock pumps off wireless

MedDevice Cyber Staff · Nov 12 · 3 min read · Via CISA ICSMA-20-317-01

CISA published advisory ICSMA-20-317-01 on November 12, 2020, for the BD Alaris PC Unit Model 8015, Version 9.33.1 and prior, and BD Alaris Systems Manager, Version 4.33 and prior. Medigate reported the vulnerability.

CVE-2020-25165 (CWE-287, CVSS v3 6.5) is a network session authentication flaw in the authentication process between the PC Unit and Systems Manager. By modifying the configuration headers of data in transit, an attacker can cause a denial of service that drops the PC Unit's wireless capability and leaves it in manual operation.

The bar is real. The attacker needs access to the network the pumps use, must redirect the PC Unit's authentication requests with custom code, and has to complete a handshake built from what those requests reveal.

Infusion continues as programmed. What disappears are the network services: pre-populating infusion parameters through EMR Interoperability and wireless updates to the Alaris System Guardrails (DERS) drug library stop working.

BD says many Systems Manager installations were already updated during normal server upgrades. Systems Manager Versions 12.0.1, 12.0.2, 12.1.0 and 12.1.2 address the flaw, and a PC Unit software release is planned. BD also recommends compensating controls that restrict which devices sit on the wireless segment and what traffic crosses to the server segment.

Losing EMR auto-programming pushes nurses back to manual entry, which is where the dose errors interoperability was meant to prevent come back.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade BD Alaris Systems Manager to 12.0.1, 12.0.2, 12.1.0 or 12.1.2 and apply the BD Alaris PC Unit software update when BD releases it. Meanwhile, restrict which devices can join the pump wireless segment and filter traffic between that segment and the Systems Manager server.

Upgrade Systems Manager. Confirm the server runs Version 12.0.1, 12.0.2, 12.1.0 or 12.1.2; many installs were already updated by BD.
Plan the PC Unit update. Schedule the BD Alaris PC Unit software release that addresses CVE-2020-25165.
Restrict the wireless segment. Limit devices on the pump wireless segment and the traffic allowed to the server segment.
Authenticate both ends of the session. Bind pump to server sessions to mutually authenticated keys so headers cannot be altered in transit.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Therapy delivery Hospital network

BD Alaris PC Unit

Wireless connectivity Therapy delivery

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
BD Alaris Infusion System with Guardrails Suite MX	BD	Names the affected product	No feedback feed from manufacturer

Questions & Answers

What is CVE-2020-25165 in the BD Alaris PC Unit?

CVE-2020-25165 is an improper authentication flaw (CWE-287, CVSS v3 6.5) in the session authentication between the BD Alaris PC Unit Model 8015 (9.33.1 and prior) and BD Alaris Systems Manager (4.33 and prior). An attacker on the network can drop the PC Unit's wireless capability, per CISA advisory ICSMA-20-317-01 from November 12, 2020.

Which BD Alaris Systems Manager versions fix CVE-2020-25165?

BD Alaris Systems Manager Versions 12.0.1, 12.0.2, 12.1.0 and 12.1.2 address CVE-2020-25165, and BD planned a BD Alaris PC Unit software release for the device side, per CISA advisory ICSMA-20-317-01.

Does the BD Alaris PC Unit keep infusing if the attack succeeds?

Yes. CISA advisory ICSMA-20-317-01 says the BD Alaris PC Unit continues to function as programmed, but EMR Interoperability auto-programming and wireless Guardrails (DERS) updates are unavailable while wireless is down.

← Back to Vulnerabilities

Key Facts

Product 1: BD Alaris PC Unit Model 8015, 9.33.1 and prior (Becton, Dickinson and Company (BD))
Device Type: Infusion pump point-of-care unit
Product 2: BD Alaris Systems Manager 4.33 and prior (Becton, Dickinson and Company (BD))
Device Type: Infusion system server software
Materials: BD Alaris Systems Manager ≤ 4.33, fixed in 12.0.1; BD Alaris PC Unit software ≤ 9.33.1; EMR Interoperability all versions
Components: Local Application, Wireless Module
Interface: WiFi
Dataflows: PC Unit to Systems Manager authentication requests over the wireless network; EMR to PC Unit via EMR Interoperability (infusion parameters); Systems Manager to PC Unit (DERS drug library wireless updates)
Assets: Alaris System Guardrails (DERS) drug library (Software Update); Infusion parameters pre-populated from EMR (Software Configuration)
Advisory: ICSMA-20-317-01
CVE: CVE-2020-25165
CVSS: 6.5
Severity: Medium
Disclosed: Nov 12, 2020
Source: CISA ICSMA-20-317-01

Sources

BD: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: BD