Vulnerability

BD tests Microsoft's Bad Neighbor patch for FACS, Pyxis and Rowa products

MedDevice Cyber Staff · Dec 3 · 3 min read · Via BD bulletin: Third-party Vulnerability: Windows TCP/IP Remote Code Execution Vulnerability (Bad Neighbor)

BD published a third-party bulletin on December 3, 2020 for CVE-2020-16898, a Windows TCP/IP remote code execution flaw in ICMPv6 Router Advertisement handling known as Bad Neighbor. Microsoft patched it on October 13, 2020.

BD lists Accuri C6 Plus, Assurity Linc, COR, DataLink, the FACS cytometers, Pyxis Anesthesia Station ES, CathRack, CIISafe, KanBan RF, MedStation ES, ProcedureStation and SupplyStation, Totalys Multiprocessor, Veritor Connect, LSR II and LSRFortessa, and Rowa Dose, vMotion and vMax. BD is testing the patch for affected products.

The bug sits in the network stack itself, so it is reachable before any application logic runs. Devices that never use IPv6 should not process it.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Microsoft patched CVE-2020-16898 on October 13, 2020, and BD was testing it for affected products as of December 3, 2020. Apply it once BD validates each product. Where IPv6 is not used, blocking ICMPv6 Router Advertisements at the network edge narrows exposure meanwhile.

Apply the validated patch. Install Microsoft's October 13, 2020 update once BD clears it for each listed product.
Filter Router Advertisements. Block or guard ICMPv6 Router Advertisements on segments hosting BD devices that do not need IPv6.
Disable unused protocols. Turn off IPv6 in device images that never use it, after manufacturer confirmation.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

BD FACS flow cytometers

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which BD products are affected by Bad Neighbor CVE-2020-16898?

BD's December 3, 2020 bulletin lists Accuri C6 Plus, Assurity Linc, COR, DataLink, FACS cytometers, multiple Pyxis systems, Totalys Multiprocessor, Veritor Connect, LSR II and LSRFortessa, and Rowa Dose, vMotion and vMax as affected by Windows TCP/IP flaw CVE-2020-16898.

Is the Microsoft patch for CVE-2020-16898 approved for BD products?

As of its December 3, 2020 bulletin, BD was testing Microsoft's October 13, 2020 patch for CVE-2020-16898 on affected BD products. Customers should follow BD's validated patch guidance.

← Back to Vulnerabilities