Vulnerability

BD FACSLyric workstations on Windows 10 expose an administrative account

MedDevice Cyber Staff · Jan 29 · 2 min read · Via CISA ICSMA-19-029-02

CISA published advisory ICSMA-19-029-02 on January 29, 2019, covering CVE-2019-6517 in BD FACSLyric workstations running Windows 10 Professional. BD reported the issue itself. Affected are the FACSLyric IVD U.S. release and the FACSLyric Research Use Only (RUO) U.S. and Malaysian releases shipped between November 2017 and November 2018.

The flaw is improper access control (CWE-284), scored 6.8 under CVSS v3. The system does not properly enforce user access control to a privileged account, so an attacker can reach administrative level functions and run arbitrary commands on the workstation. The vector requires physical access but no privileges or user interaction.

FACSLyric systems on Windows 7 are not affected. That ties the flaw to the Windows 10 build as shipped rather than to the FACSLyric application.

BD is handling remediation directly with each affected user. It will disable the administrative account on FACSLyric RUO Cell Analyzer units and replace the computer workstations on FACSLyric IVD Cell Analyzer units.

Replacing hardware to close an account problem is expensive, and it is the cost of an image built without a lockdown checklist.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD is contacting every affected FACSLyric user: RUO units get the administrative account disabled and IVD units get a replacement workstation. Labs should confirm the work is done on each Windows 10 Pro unit. Windows 7 systems need no action.

Inventory Windows 10 FACSLyric units. Identify IVD and RUO systems shipped with Windows 10 Pro, including RUO units from November 2017 to November 2018.
Complete the BD remediation. Confirm BD has disabled the admin account on RUO units and replaced the workstation on IVD units.
Control physical access. Exploitation needs hands on the workstation, so keep instruments in access-controlled lab space until remediated.
Harden the OS image before shipping. Device makers should disable or lock every privileged account in the shipped Windows image and verify it in release testing.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system Role-based access

FACSLyric

PID-23 Named operating system Role-based access

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2019-6517 in the BD FACSLyric flow cytometer?

CVE-2019-6517 (CVSS 6.8) is improper access control to a privileged account on BD FACSLyric workstations running Windows 10 Professional, which may give an attacker with physical access administrative level functions. CISA covered it in advisory ICSMA-19-029-02 on January 29, 2019.

Which BD FACSLyric systems are affected by CVE-2019-6517?

Per CISA advisory ICSMA-19-029-02, affected are BD FACSLyric IVD systems on Windows 10 Pro (U.S. release) and FACSLyric RUO systems on Windows 10 Pro (U.S. and Malaysian releases) from November 2017 to November 2018. FACSLyric systems on Windows 7 are not affected.

How is BD remediating the FACSLyric administrative account flaw?

BD will disable the administrative account on FACSLyric RUO Cell Analyzer units with Windows 10 Pro and replace the computer workstations for FACSLyric IVD Cell Analyzer units with Windows 10 Pro, following up directly with each affected user, per CISA advisory ICSMA-19-029-02.

← Back to Vulnerabilities