Vulnerability

BD lists FACS, Pyxis and Kiestra products in scope for Win32k zero-day CVE-2021-1732

MedDevice Cyber Staff · Jul 29 · 2 min read · Via BD bulletin: Third-party Vulnerability Microsoft Win32k

BD published a third-party bulletin on July 29, 2021 for CVE-2021-1732, a Microsoft Win32k zero-day affecting Windows 10 and Windows Server 2019. BD lists the products that use the affected components, among them the FACSAria, FACSCanto, FACSLyric and FACSymphony cytometers, the LSR II and LSRFortessa, Pyxis MedStation ES and SupplyStation, Kiestra lab automation, Rowa pharmacy systems, Accuri C6 Plus, COR and EpiCenter.

CVE-2021-1732 is a Win32k elevation of privilege flaw, so it turns any foothold on the workstation into full control. BD reports no exploitation on its products. The list shows how far one Windows kernel bug reaches across a single manufacturer's catalogue.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Microsoft patched CVE-2021-1732, and BD's July 29, 2021 bulletin lists the BD products that use the affected Windows components. Customers should apply the Microsoft update under BD's validated patch guidance for each product. Restrict local logins on instrument workstations until the patch is in.

Apply the validated Windows patch. Install the Microsoft fix for CVE-2021-1732 on listed BD systems per BD's patch guidance.
Cut local access. Remove unneeded interactive accounts on instrument and cabinet workstations.
Track the OS build. Record the Windows version of every BD workstation so the next kernel bulletin maps in minutes.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

BD FACS flow cytometers

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity Gateway Suite	Dräger	Same named componentWindows Server (2019)	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same named componentWindows Server (2019)	No feedback feed from manufacturer

Questions & Answers

Which BD products are affected by CVE-2021-1732?

BD's July 29, 2021 bulletin lists BD products using Windows 10 or Windows Server 2019 components affected by Win32k CVE-2021-1732, including FACS cytometers, LSR II and LSRFortessa, Pyxis MedStation ES, Pyxis SupplyStation, Kiestra, Rowa, Accuri C6 Plus, BD COR and BD EpiCenter.

Has CVE-2021-1732 been exploited on BD devices?

BD's July 29, 2021 bulletin reports no exploitation of the Win32k zero-day CVE-2021-1732 on BD products.

← Back to Vulnerabilities