Vulnerability

BD Alaris PC Unit 8015 BusyBox flaws expose Wi-Fi credentials through crafted DHCP

MedDevice Cyber Staff · Oct 26 · 3 min read · Via BD bulletin: Third-Party Vulnerability BusyBox

BD published a third-party vulnerability bulletin on October 26, 2023 for BusyBox flaws in the BD Alaris PC Unit Model 8015 and the BD FocalPoint Slide Profiler APPS Workstation 3.7.0 to 3.8.1. The CVEs are CVE-2016-2148, CVE-2018-1000517, CVE-2018-20679 and CVE-2019-5747.

An unauthorized user on a customer's wireless network could reach wireless credentials or sensitive data by sending a crafted DHCP message. BusyBox is a compact bundle of Unix utilities, including a DHCP client, common in embedded Linux.

BD released Alaris PC Unit software 12.3.1 to address three of the four CVEs. BD does not name a fix for the fourth here, so operators should check the BD page for its status on each product.

A DHCP client answers whoever replies first on the network it joins, and that makes the wireless segment part of the pump's attack surface.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD released Alaris PC Unit software 12.3.1, which addresses three of the four BusyBox CVEs. Hospitals should schedule the upgrade and check BD's bulletin for FocalPoint Slide Profiler APPS Workstation status. Tighten the wireless segment so unknown hosts cannot answer pump DHCP requests.

Upgrade to 12.3.1. Move Alaris PC Unit Model 8015 fleets to software 12.3.1 through BD.
Check FocalPoint workstations. Confirm the fix status for FocalPoint Slide Profiler APPS Workstation 3.7.0 to 3.8.1 with BD.
Lock down the pump Wi-Fi. Restrict which hosts can join the infusion SSID and run DHCP snooping so only the real server answers.
Inventory embedded components. Keep BusyBox and its version in the device SBOM so new CVEs map to products quickly.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Contributing

Wireless connectivity

BD Alaris PC Unit

Wireless connectivity Off-the-shelf software

BD FocalPoint Slide Profiler APPS Workstation

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

What BusyBox vulnerabilities affect the BD Alaris PC Unit 8015?

BD's October 26, 2023 bulletin lists CVE-2016-2148, CVE-2018-1000517, CVE-2018-20679 and CVE-2019-5747 in BusyBox, a third-party component in the Alaris PC Unit Model 8015 and FocalPoint Slide Profiler APPS Workstation 3.7.0 to 3.8.1.

Is there a patch for the Alaris PC Unit BusyBox flaws?

Yes, in part. BD released Alaris PC Unit software 12.3.1, which addresses three of the four BusyBox CVEs named in its October 26, 2023 bulletin.

How could the BD BusyBox vulnerability be exploited?

BD's October 26, 2023 bulletin says an unauthorized user on a customer's wireless network could reach wireless credentials or sensitive data through a crafted DHCP message to an affected Alaris PC Unit 8015 or FocalPoint Slide Profiler APPS Workstation.

← Back to Vulnerabilities