Vulnerability

BD Pyxis keeps access for expired Active Directory accounts when joined to a hospital domain

MedDevice Cyber Staff · Sep 5 · 3 min read · Via CISA ICSMA-19-248-01

CISA published advisory ICSMA-19-248-01 (Update A) on September 5, 2019, for a session fixation vulnerability in Becton, Dickinson and Company (BD) Pyxis medication dispensing products. CVE-2019-13517 (CWE-384) carries a CVSS v3 base score of 7.6. BD reported the issue itself.

Affected products are Pyxis ES versions 1.3.4 to 1.5.3 and Pyxis Enterprise Server with Windows Server versions 4.4 to 4.12, as CISA lists them. The flaw only applies when a product is joined to an Active Directory domain: existing access privileges are not cut off when the user's AD account expires or changes.

In practice, a former employee or a disabled account can keep the level of access it had before expiration. On a dispensing cabinet that means patient data and medications. The vector requires an adjacent network position and a low-privilege account, which fits an insider far better than an outside attacker.

BD notes that connecting dispensing cabinets to a hospital domain is uncommon and not recommended. It reports the issue remediated in the latest software release, though it has been unable to reproduce it since first testing it earlier in the year.

Offboarding is a security control. When a dispensing cabinet trusts the domain, the cabinet has to honor the domain's account expiry the same moment the directory does.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD reports CVE-2019-13517 remediated in the latest Pyxis software release, so move Pyxis ES and Pyxis Enterprise Server installs to it. Sites not joined to an Active Directory domain are not affected. If the cabinets must stay on the hospital domain, tie account removal to an explicit revocation on the Pyxis side.

Install the latest Pyxis release. BD reports the latest software release remediates CVE-2019-13517 for Pyxis ES and Pyxis Enterprise Server.
Check whether the cabinets use AD. Only products that log in through Active Directory and sit on the hospital domain are exposed.
Revoke Pyxis access at offboarding. Remove departing users from Pyxis directly rather than relying on AD account expiry alone.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts Hospital network

Contributing

Handles patient data Named operating system

Pyxis ES

User accounts Hospital network Handles patient data

Pyxis Enterprise Server

PID-23 Named operating system User accounts

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Harmony Referral System	Topcon Healthcare	Same named componentWindows Server (any version)	No feedback feed from manufacturer

Questions & Answers

What is CVE-2019-13517 in BD Pyxis?

CVE-2019-13517 (CWE-384, CVSS v3 7.6) is a session fixation flaw in BD Pyxis ES and Pyxis Enterprise Server where access privileges are not revoked when an Active Directory account expires. CISA covered it in advisory ICSMA-19-248-01 on September 5, 2019.

Does CVE-2019-13517 affect BD Pyxis systems that do not use Active Directory?

No. Per CISA advisory ICSMA-19-248-01, BD Pyxis products are only affected when they actively use Active Directory for login and are connected to the hospital domain. BD says connecting dispensing cabinets to a hospital domain is uncommon and not recommended.

← Back to Vulnerabilities