Vulnerability

BD lists more than 20 product lines in scope for PrintNightmare CVE-2021-34527

MedDevice Cyber Staff · Aug 16 · 3 min read · Via BD bulletin: Third-party Vulnerability Windows Print Spooler (PrintNightmare)

BD published a third-party bulletin on August 16, 2021 for PrintNightmare, the remote code execution vulnerability in the Windows Print Spooler service tracked as CVE-2021-34527. The product list runs from Arctic Sun Analytics and Arctic Sun Stat through BACTEC, BD MAX, Phoenix M50, FocalPoint, the FACS cytometers, Pyxis systems, Rowa, Totalys, Viper LT, Sherlock 3CG and Site~Rite 8.

BD has received no reports of exploitation on its products. The Print Spooler runs by default on Windows, including on many machines that never print.

Any Windows service a device does not use is attack surface with no clinical return. Turn it off in the golden image.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Microsoft released fixes for CVE-2021-34527, and BD's August 16, 2021 bulletin lists the BD products in scope. Customers should apply the update per BD's validated guidance for each product. Where printing is not needed, disabling the Print Spooler service removes the exposure entirely.

Apply the validated patch. Install Microsoft's PrintNightmare fix on listed BD systems following BD's product guidance.
Disable the spooler where idle. Stop and disable the Print Spooler on BD workstations that do not print, after confirming with BD.
Trim the base image. Ship device images with unused Windows services disabled by default.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

BD BACTEC

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which BD products are affected by PrintNightmare?

BD's August 16, 2021 bulletin lists products in scope for PrintNightmare CVE-2021-34527, including Arctic Sun Analytics and Stat, BACTEC 9240/9120 and FX, BD MAX, Phoenix M50, FocalPoint, FACS cytometers, Pyxis systems, Rowa, Totalys, Viper LT, Sherlock 3CG and Site~Rite 8.

Has PrintNightmare CVE-2021-34527 been exploited on BD products?

BD's August 16, 2021 bulletin says BD has received no reports of PrintNightmare CVE-2021-34527 exploitation on its products.

← Back to Vulnerabilities