BD published a bulletin on October 27, 2017 on the WPA2 KRACK vulnerabilities. An attacker within physical range can use them to manipulate data traffic and partially disclose encrypted communication.
BD lists the Alaris PC Unit Models 8000 and 8015, the Alaris Gateway Workstation, Pyxis Anesthesia ES, 4000 and 3500, Pyxis MedStation 4000 T2 and ES, Pyxis SupplyStation, Supply Roller, ParAssist, PARx and PARx handheld, CIISafe Workstation and StockStation. BD reports no verified malicious exploitation against BD devices. Some listed products were patched and others require customer coordination.
KRACK abuses the WPA2 handshake by replaying messages to force a key reinstallation. Infusion pumps on Wi-Fi should never depend on the radio layer alone for confidentiality, so encrypt the application traffic too.
Questions & Answers
Which BD devices are affected by KRACK?
BD's October 27, 2017 bulletin lists Alaris PC Unit Models 8000 and 8015, the Alaris Gateway Workstation, Pyxis Anesthesia ES, 4000 and 3500, Pyxis MedStation 4000 T2 and ES, Pyxis SupplyStation, Supply Roller, ParAssist, PARx and PARx handheld, CIISafe Workstation and StockStation as in scope for the WPA2 KRACK vulnerabilities.
Is there a KRACK patch for BD Alaris and Pyxis devices?
BD's October 27, 2017 bulletin says some listed Alaris and Pyxis products were patched for WPA2 KRACK and others require customer coordination with BD.
What can an attacker do with KRACK against BD devices?
Per BD's October 27, 2017 bulletin, an attacker within physical range can use WPA2 KRACK to manipulate data traffic and partially disclose encrypted communication. BD reports no verified malicious exploitation against BD devices.