Vulnerability

BD Alaris Plus syringe pumps accept unauthenticated commands through a terminal server

MedDevice Cyber Staff · Aug 23 · 2 min read · Via CISA ICSMA-18-235-01

CISA published advisory ICSMA-18-235-01 on August 23, 2018, for CVE-2018-14786 in BD Alaris Plus syringe pumps: the Alaris CC, GH, GS and TIVA models at software version 2.3.6 and earlier. The weakness is improper authentication (CWE-287) with a CVSS v3 base score of 9.4. Elad Luz of CyberMDX reported it.

The software does not perform authentication for functionality that requires a provable user identity. The exposure appears when a pump is connected to a terminal server through its serial port, which puts that serial interface on a TCP/IP network. CISA rated integrity and availability impact high, meaning a remote attacker could interfere with the intended operation of the pump. On a syringe pump, integrity means the infusion itself.

BD set out the limits. The attack cannot be performed when the pump is connected to an Alaris Gateway Workstation docking station, an attacker cannot switch the device on remotely, and no PHI or PII can be accessed. BD also determined that the affected products are not sold within the United States.

A serial port assumes a cable to a trusted box. Once a terminal server bridges it to the network, the bridge needs the access control the pump never had.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The advisory names no software fix for CVE-2018-14786; BD points to mitigations and compensating controls. The attack cannot be performed when an Alaris Plus pump is docked in an Alaris Gateway Workstation, so docking is the direct control. Any pump whose serial port runs through a terminal server should be treated as exposed until that path is removed or locked down.

Dock pumps in the Gateway Workstation. BD reports the attack cannot be performed on a pump connected to an Alaris Gateway Workstation docking station.
Inventory terminal server connections. Find every Alaris Plus serial port bridged to TCP/IP and disconnect the ones without a clinical need.
Restrict access to remaining bridges. Place any terminal server that must stay on a segment reachable only by the systems that need it.
Contact BD product security. Get BD's current guidance for CC, GH, GS and TIVA pumps at version 2.3.6 and earlier.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Serial interface

Contributing

Therapy delivery Wired network

Alaris Plus syringe pumps

PID-14 PID-331 Serial interface Therapy delivery

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Questions & Answers

Which BD Alaris Plus syringe pumps are affected by CVE-2018-14786?

CVE-2018-14786 affects the BD Alaris Plus CC, GH, GS and TIVA syringe pumps at software version 2.3.6 and earlier, according to CISA advisory ICSMA-18-235-01 published August 23, 2018. BD determined the affected products are not sold within the United States.

Can CVE-2018-14786 be exploited on a BD Alaris Plus pump docked in an Alaris Gateway Workstation?

No. BD reports that the CVE-2018-14786 attack on Alaris Plus syringe pumps cannot be performed when the pump is connected to an Alaris Gateway Workstation docking station. The exposure applies when the pump's serial port is connected to a terminal server.

Does CVE-2018-14786 in BD Alaris Plus pumps expose patient data?

BD states that no PHI or PII can be accessed by exploiting CVE-2018-14786 in the Alaris Plus CC, GH, GS and TIVA syringe pumps, and that an attacker cannot switch the device on remotely. The risk is to the pump's intended operation.

← Back to Vulnerabilities