Default credentials across a line of diagnostic instruments

MedDevice Cyber Staff · Dec 17 · 2 min read · Via CISA

BD Diagnostic Solutions products, the BACTEC, COR, EpiCenter, MAX, Phoenix M50 and Synapsys lines, drew ICSMA-24-352-01. CVE-2024-10476, default credentials, base score 8.0. BD published it on its own bulletin page and is remediating through field service.

Default credentials are the logins a device leaves the factory with so it can be set up and serviced, ordinarily documented and ordinarily meant to be replaced once the instrument is in place. That step is skipped often enough that the pattern has become one of the most durable weaknesses in connected equipment. When a whole product line shares one scheme, a credential learned from a single manual or unit generalizes across the family.

An attacker with logical or physical network access uses the shipped login and reads, modifies or deletes data, including PHI. Credit to BD for publishing, because its cybersecurity bulletin page is one of the more complete in the industry, and transparency about your own findings is what regulators and customers increasingly expect. Force credential change on first setup. A device that keeps working with the factory password will still have it in five years, on a network someone eventually reaches.

Instruments of this kind sit at the head of clinical decisions, culturing specimens and returning the results that steer treatment. Access allowing those results to be read, altered or deleted is more than a privacy exposure of the health information they hold; it is a path to delayed or misdirected care when a result is quietly changed or erased. The silence of such tampering is part of the hazard, since a laboratory trusts the figure its analyzer reports.

Repairing a fault embedded in deployed hardware through field service means a technician reaching each installed unit in turn, the slower road taken when a setting cannot be pushed over the network. That the disclosure surfaced on the maker's own security bulletin reflects a wider divide, between makers running a visible product-security process and the many that publish nothing.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD Diagnostic Solutions instruments including BACTEC and Phoenix shipped with default credentials, letting an attacker with network access read, modify or delete data including PHI (ICSMA-24-352-01). Change the defaults, segment the instruments, and follow the BD guidance.

Change the default credentials. Set unique credentials on every affected instrument per the BD advisory in ICSMA-24-352-01.
Segment the instruments. Keep diagnostic instruments on a controlled network segment so default-credential access is not reachable broadly.
Force a credential change at setup. Devices should require the default to be changed before they become operational.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

data_phi

Contributing

net_wired net_remote_access app_user_accounts net_wireless app_web_ui app_roles app_database use_hospital_net sys_ots_software

EMB3D

PID-332 PID-3321

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

Which BD instruments shipped with default credentials?

The BACTEC, COR, EpiCenter, MAX, Phoenix M50 and Synapsys lines, covered by ICSMA-24-352-01 as CVE-2024-10476, base score 8.0.

What could an attacker do with the BD default credentials?

With logical or physical network access, log in using the shipped credentials and read, modify or delete data, including protected health information.

How is BD remediating the default credential finding?

BD published the advisory on its own bulletin page and is remediating through field service. The durable fix for this bug class is forcing a credential change on first setup.

← Back to Vulnerabilities