Vulnerability

BD Alaris Infusion Central leaves a recoverable database password after installation

MedDevice Cyber Staff · Feb 16 · 2 min read · Via CISA ICSMA-23-047-01

CISA published advisory ICSMA-23-047-01 on February 16, 2023, for BD Alaris Infusion Central software, versions 1.1 through 1.3.2. BD reported the single vulnerability, CVE-2022-47376, storing passwords in a recoverable format (CWE-257), with a CVSS v3.1 base score of 7.3.

After installation the software may contain a recoverable password. An attacker who gets it can obtain the database installation password and reach the Alaris Infusion Central database, which could disclose or allow tampering with resident personal data. The vector is local and needs low privileges. Patient health data is not stored in that database, though BD notes some sites choose to store personal data there.

BD is reaching out directly to the small group of customers who may be affected to start remediation, and its security bulletin carries the details. In the meantime it recommends changing passwords periodically and making sure only authorized administrators have physical access to the Alaris Infusion Central server.

Installers that leave credentials behind on disk are a recurring finding. Post-install cleanup belongs in the release checklist, verified by a scan of the installed image.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Work with BD on the remediation it is coordinating directly with affected Alaris Infusion Central 1.1 to 1.3.2 sites. Until it is complete, rotate the database and application passwords and restrict physical and console access to the server to authorized administrators. Check whether your site stores personal data in the database.

Engage BD. Confirm with BD whether your Alaris Infusion Central installation is in the affected group and schedule remediation.
Rotate passwords. Change the database installation password and related credentials on the server.
Restrict server access. Limit physical and interactive access to the Alaris Infusion Central server to named administrators.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Patient or study database

Contributing

User accounts Hospital network

Alaris Infusion Central

PID-3321 Patient or study database User accounts

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
LOGIQ e	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
da Vinci SP Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
ProBeam 360 Proton Therapy System v3.0	Varian	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer

Questions & Answers

What is CVE-2022-47376 in BD Alaris Infusion Central?

CVE-2022-47376 is a recoverable password flaw (CWE-257, CVSS v3.1 7.3) in BD Alaris Infusion Central 1.1 through 1.3.2. A password left after installation can let an attacker obtain the database installation password and access resident personal data. CISA disclosed it in advisory ICSMA-23-047-01 on February 16, 2023.

How do I fix the BD Alaris Infusion Central password vulnerability?

BD is contacting the small group of potentially affected Alaris Infusion Central 1.1 to 1.3.2 customers directly to remediate CVE-2022-47376, per CISA advisory ICSMA-23-047-01. Until then BD recommends changing passwords periodically and limiting physical access to the server to authorized administrators.

← Back to Vulnerabilities