Vulnerability

BD Alaris System with Guardrails Suite MX has unsigned wireless firmware and tamperable datasets

MedDevice Cyber Staff · Jul 13 · 4 min read · Via CISA ICSMA-23-194-01

CISA published advisory ICSMA-23-194-01 on July 13, 2023, covering eight vulnerabilities across the BD Alaris System with Guardrails Suite MX. BD disclosed them itself. Affected components are the Alaris Point-of-Care Unit (PCU) Model 8015 12.1.3 and prior, Guardrails Editor 12.1.2 and prior, Systems Manager 12.3 and prior, CQI Reporter 10.17 and prior, and Calculation Services 1.0 and prior.

Three flaws sit on the PCU itself. CVE-2023-30559 (CVSS 5.2): the firmware update package for the wireless card is not properly signed and can be modified. CVE-2023-30560 (CVSS 6.8): the PCU configuration can be changed without authentication over a physical connection. CVE-2023-30561 (CVSS 6.1): data between the PCU and its modules is unprotected, so someone with physical access could read or modify it by attaching a crafted device during an infusion.

CVE-2023-30562 (CVSS 6.7) is the one that reaches every pump on the floor. A Guardrails Editor dataset file inside Systems Manager can be tampered with and then distributed to the PCUs. The dataset carries the dosing limits, so integrity here is a medication safety control.

The server side adds two cross-site scripting flaws in Systems Manager: CVE-2023-30563 (CVSS 8.2, the highest in the set), where a malicious file uploaded through the User Import Function can hijack a session, and CVE-2023-30564 (CVSS 6.9) in the Device Import Function. CVE-2023-30565 (CVSS 3.5) is an insecure connection to CQI Reporter that could expose infusion data, and CVE-2018-1285 (CVSS 3.0) is an outdated Apache Log4Net component.

The fixes arrived in pieces. BD Alaris System 12.3 includes Guardrails Editor 12.1.3, which partially remediates CVE-2023-30562 and drops its score from 6.7 to 3.0. System 12.3 is no longer compatible with CQI Reporter 10.17, so CVE-2023-30565 no longer applies. Systems Manager 12.5.1 and Calculation Services 1.1.1 remediate CVE-2018-1285, CVE-2023-30563, CVE-2023-30564 and CVE-2023-30565.

The PCU fixes did not ship. BD said the PCU Model 8015 version 12.3.1 released with System 12.3 still carries CVE-2023-30559, CVE-2023-30560 and CVE-2023-30561, and that its bulletin would be updated when remediation is available. Updates depend on regulatory authorization and are scheduled through the BD Account Executive.

Signing the radio firmware is the cheap part of pump security, and it is still open here.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Move to BD Alaris System 12.3 where regulatory authorization allows, then to Systems Manager 12.5.1 and Calculation Services 1.1.1, through your BD Account Executive. Three PCU Model 8015 flaws (CVE-2023-30559, CVE-2023-30560, CVE-2023-30561) have no fix yet, so control physical access to pumps and restrict network traffic to required ports on required endpoints.

Upgrade to BD Alaris System 12.3. Schedule it with your BD Account Executive; it brings Guardrails Editor 12.1.3 and retires the CQI Reporter 10.17 connection.
Install Systems Manager 12.5.1. Apply it with Calculation Services 1.1.1 to fix the import function XSS flaws and the Log4Net component.
Guard the PCUs physically. The open PCU flaws need a physical connection, so keep pumps in controlled areas and inspect for attached devices.
Filter pump network traffic. Use firewalls or ACLs to limit device traffic to the required ports on the required endpoints.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Field-updatable firmware Therapy delivery

Contributing

Wireless connectivity File import Hospital network

BD Alaris Point-of-Care Unit (PCU) Model 8015

PID-271 PID-14 Field-updatable firmware Wireless connectivity Therapy delivery

BD Alaris Systems Manager

File import

BD Alaris Guardrails Editor

Therapy delivery

CQI Reporter

PID-4112

Fix the class in your product

The updater does not verify who it talks to or what it installs. As the maker, verify the server certificate and a cryptographic signature on the payload against a device-provisioned key before anything is written. Transport and payload signing are separate controls, and you need both.

Sign the payload. Verify a signature against a key provisioned on the device; refuse unsigned or tampered images.
Verify the server. Validate the full TLS chain and reject a mismatch rather than proceeding.
Block rollback. Refuse downgraded images so an attacker cannot force a known-vulnerable version.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
BD Alaris System with Guardrails Suite MX v12.1.2	BD	Names the affected product	No feedback feed from manufacturer

Questions & Answers

What is CVE-2023-30559 in the BD Alaris PCU Model 8015?

CVE-2023-30559 (CVSS 5.2) means the firmware update package for the wireless card in the BD Alaris Point-of-Care Unit (PCU) Model 8015 12.1.3 and prior is not properly signed and can be modified. CISA advisory ICSMA-23-194-01, published July 13, 2023, says it remains present in PCU version 12.3.1.

Does BD Alaris System 12.3 fix the Guardrails dataset tampering flaw CVE-2023-30562?

Partially. BD Alaris System 12.3, which includes Guardrails Editor 12.1.3, reduces CVE-2023-30562 from CVSS 6.7 to 3.0, and Systems Manager 12.5.1 adds further partial remediation, per CISA advisory ICSMA-23-194-01 from July 13, 2023.

Which BD Alaris Systems Manager version fixes CVE-2023-30563?

BD Alaris Systems Manager 12.5.1 and Calculation Services 1.1.1 remediate CVE-2023-30563, a CVSS 8.2 cross-site scripting flaw in the User Import Function, along with CVE-2023-30564, CVE-2023-30565 and CVE-2018-1285, according to CISA advisory ICSMA-23-194-01, published July 13, 2023.

← Back to Vulnerabilities

Key Facts

Product 1: BD Alaris Point-of-Care Unit (PCU) Model 8015 12.1.3 and prior (Becton, Dickinson and Company (BD))
Device Type: Infusion pump controller
Product 2: BD Alaris Systems Manager 12.3 and prior (Becton, Dickinson and Company (BD))
Device Type: Infusion system management server
Product 3: BD Alaris Guardrails Editor 12.1.2 and prior (Becton, Dickinson and Company (BD))
Device Type: Drug library editor
Product 4: CQI Reporter 10.17 and prior (Becton, Dickinson and Company (BD))
Device Type: Infusion data reporting software
Product 5: Calculation Services 1.0 and prior (Becton, Dickinson and Company (BD))
Device Type: Infusion system software service
Material: Apache Log4Net all versions, fixed in Systems Manager 12.5.1 and Calculation Services 1.1.1
Components: Firmware, Wireless Module, Web Application, Local Application, Generic Application, Generic Hardware
Interfaces: Wireless, Unknown, TCP
Dataflows: Guardrails Editor to Systems Manager (dataset file); Systems Manager to PCU (Guardrails dataset distribution); PCU to PCU modules (module data); Systems Manager to CQI Reporter (infusion data); User file to Systems Manager (User Import Function upload)
Assets: wireless card firmware update package (Firmware); PCU configuration (Software Configuration); Guardrails dataset (dosing limits) (Software Configuration); infusion data (Telemetry Data); Systems Manager session (Tokens); User import data (User Data)
Advisory: ICSMA-23-194-01
CVEs: CVE-2023-30559, CVE-2023-30562
Severity: High
Disclosed: Jul 13, 2023
Source: CISA ICSMA-23-194-01

Sources

BD: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: BD