Vulnerability

BD lists FocalPoint, Kiestra and BD MAX in scope for three Remote Desktop flaws

MedDevice Cyber Staff · Apr 3 · 2 min read · Via BD bulletin: Product Security Bulletin for Third-Party Remote Desktop Vulnerabilities

BD published a third-party bulletin on April 3, 2020 for three Microsoft Remote Desktop remote code execution vulnerabilities: CVE-2020-0609, CVE-2020-0610 and CVE-2020-0611. BD lists FocalPoint Large Lab Server, Kiestra InoqulA, TLA and WCA, Specimen Collection Verification, BACTEC Touch, EpiCenter, HealthSight Analytics, Knowledge Portal, BD MAX and MedMined.

BD is testing Microsoft's patches for the affected products. Remote Desktop is often how service staff reach lab systems, so it tends to stay open longer than any other port. Put it behind a gateway that requires its own authentication.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD was testing Microsoft's patches for CVE-2020-0609, CVE-2020-0610 and CVE-2020-0611 as of April 3, 2020. Apply them once BD validates each product. Keep Remote Desktop off the open network and require a separate gateway login.

Apply validated patches. Install Microsoft's fixes on listed BD systems after BD clears them.
Close RDP exposure. Block Remote Desktop to BD systems from anything but a managed jump host.
Log service sessions. Record who connects to BD systems over Remote Desktop and when.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Remote access

BD Kiestra

Remote access

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which BD products are affected by CVE-2020-0609?

BD's April 3, 2020 bulletin lists FocalPoint Large Lab Server, Kiestra InoqulA, TLA and WCA, Specimen Collection Verification, BACTEC Touch, EpiCenter, HealthSight Analytics, Knowledge Portal, BD MAX and MedMined for Remote Desktop flaws CVE-2020-0609, CVE-2020-0610 and CVE-2020-0611.

Is BD patching the 2020 Remote Desktop vulnerabilities?

As of April 3, 2020, BD was testing Microsoft's patches for CVE-2020-0609, CVE-2020-0610 and CVE-2020-0611 on affected BD products.

← Back to Vulnerabilities