Vulnerability

BD lists BACTEC, Kiestra and Pyxis systems in scope for .NET flaw CVE-2020-1147

MedDevice Cyber Staff · Sep 28 · 3 min read · Via BD bulletin: Third-Party Vulnerability: Microsoft .Net, SharePoint and Visual Studio

BD published a third-party bulletin on September 28, 2020 for CVE-2020-1147, a remote code execution flaw in Microsoft .NET Framework, SharePoint and Visual Studio. Microsoft patched it on July 14, 2020.

BD lists products that use affected Windows versions: Assurity Linc, BACTEC BOW, FX40 and FX, COR, DataLink, BD Diabetes Care (Briight), EpiCenter, FocalPoint GSRS and lab servers, Intelliport Gateway and Tablet, Kiestra, BD MAX, Phoenix M50, Pyxis IV Prep, Logistics Server, MedStation 4000 and Server ES, Synapsys, Totalys and Viper LT.

The .NET runtime ships inside most Windows-based instrument software, often without the operator knowing which version. That runtime belongs in the SBOM next to the OS.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Microsoft patched CVE-2020-1147 on July 14, 2020. Customers should install the update on listed BD systems following BD's validated patch guidance. Manufacturers should track the .NET runtime version per product.

Install the July 2020 update. Apply Microsoft's fix for CVE-2020-1147 on listed BD systems per BD guidance.
Limit untrusted input. Keep listed BD workstations from opening files from untrusted sources.
Record the runtime. List .NET Framework versions in each product SBOM.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

BD BACTEC

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which BD products are affected by CVE-2020-1147?

BD's September 28, 2020 bulletin lists Assurity Linc, BACTEC, COR, DataLink, BD Diabetes Care (Briight), EpiCenter, FocalPoint, Intelliport, Kiestra, BD MAX, Phoenix M50, Pyxis IV Prep, Logistics Server, MedStation 4000 and Server ES, Synapsys, Totalys and Viper LT for the .NET flaw CVE-2020-1147.

When was CVE-2020-1147 patched?

Microsoft patched the .NET Framework, SharePoint and Visual Studio remote code execution flaw CVE-2020-1147 on July 14, 2020, per BD's September 28, 2020 bulletin.

← Back to Vulnerabilities