Vulnerability

BD lists Pyxis, HealthSight and Alaris servers as affected by VMware ESXi flaws

MedDevice Cyber Staff · Jun 4 · 2 min read · Via BD bulletin: Third-Party Vulnerability VMware (VMware ESXi, Workstation, Fusion and NSX-T)

BD published a third-party bulletin on June 4, 2021 for six VMware vulnerabilities: CVE-2020-3992, CVE-2020-3993, CVE-2020-3981, CVE-2020-3982, CVE-2020-3994 and CVE-2020-3995. They affect ESXi, Workstation, Fusion and NSX-T and were corrected in VMware's October 20, 2020 patch release. BD lists 16 products, including Alaris Systems Manager, the HealthSight suite, Intelliport, Kiestra, the Knowledge Portals and Pyxis Enterprise, Logistics, MedStation 4000 and SupplyStation servers.

BD has not received reports of exploitation on BD products. The listed BD server products run on VMware infrastructure, so a hypervisor flaw puts every guest on the host in the blast radius. Patch the host on the hypervisor vendor's schedule.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

VMware corrected the six CVEs in its October 20, 2020 patch release. Customers hosting the listed BD products should apply that release to ESXi hosts per BD's guidance. Keep hypervisor management interfaces on an isolated network.

Patch the hosts. Apply VMware's October 20, 2020 release to ESXi hosts running listed BD products.
Isolate management. Keep ESXi and NSX-T management interfaces on a dedicated admin network.
Record the hypervisor. List the hypervisor and its version as a dependency of each BD server deployment.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Pyxis server products

PID-242 Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
BD Alaris Infusion System with Guardrails Suite MX	BD	Names the affected product	No feedback feed from manufacturer

Questions & Answers

Which BD products are affected by the October 2020 VMware ESXi vulnerabilities?

BD's June 4, 2021 bulletin lists 16 BD products, including Alaris Systems Manager, HealthSight Clinical Advisor, Data Manager, Diversion Management, Infection Advisor and Inventory Optimization, Intelliport, Kiestra, the Knowledge Portals and Pyxis server products, as affected by VMware CVE-2020-3992 and related flaws.

When did VMware fix CVE-2020-3992?

VMware corrected CVE-2020-3992, CVE-2020-3993, CVE-2020-3981, CVE-2020-3982, CVE-2020-3994 and CVE-2020-3995 in its October 20, 2020 patch release, according to BD's June 4, 2021 bulletin.

← Back to Vulnerabilities