Vulnerability

BD Pyxis products may still run on shared default operating system credentials

MedDevice Cyber Staff · May 31 · 3 min read · Via CISA ICSMA-22-151-01

CISA published advisory ICSMA-22-151-01 on May 31, 2022, covering CVE-2022-22767 across all versions of 16 BD products: the Pyxis MedStation ES, MedStation ES Server, MedStation 4000, Anesthesia Station ES, CIISafe, Logistics, MedBank, ParAssist, Rapid Rx, StockStation, SupplyCenter, SupplyRoller, the SupplyStation family, and BD Rowa Pouch Packaging Systems. BD disclosed it.

Specific Pyxis products were installed with default credentials and may still operate with them. BD said products may share the same default local operating system credentials or domain-joined server credentials across product types. An attacker on the adjacent network could use them for privileged access to the underlying file system and to ePHI. The CVSS v3 score is 8.8.

Shared credentials turn one compromised unit into a fleet compromise. When the same local or domain account works on every station and server type, there is no blast radius to speak of.

BD's response is a process change more than a patch. Its service personnel are working with users whose domain-joined server credentials need updates, and it is piloting a credential management solution for specific Pyxis versions. Changes to installation, upgrade and applications were still being evaluated. BD's bulletin lists compensating controls for sites still on default credentials.

Rotating a vendor-installed service account is unglamorous work, and it closes more risk than most patches.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Contact BD service to confirm whether your Pyxis servers and stations still use installation default or shared credentials, and have them rotated. Apply the compensating controls in BD's bulletin and isolate Pyxis systems from general hospital networks until the credential management solution reaches your versions.

Inventory Pyxis credentials. Ask BD service which local and domain accounts were set at installation and whether they are shared across product types.
Rotate shared accounts. Work with BD to replace default domain-joined server credentials with unique ones.
Apply BD's compensating controls. Follow the controls in the BD Pyxis default credentials bulletin.
Segment the Pyxis fleet. Keep Pyxis stations and servers on a restricted segment to reduce adjacent network exposure.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Handles patient data Hospital network Wired network

BD Pyxis

PID-3321 PID-23 User accounts Handles patient data

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
LOGIQ e	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
da Vinci SP Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
CT Collaboration Live	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Image Management V15	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ARIA Radiation Therapy Management	Varian	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

Questions & Answers

What is CVE-2022-22767 in BD Pyxis?

CVE-2022-22767 (CVSS v3 8.8) covers BD Pyxis products installed with default credentials that may be shared across product types and domain-joined servers, allowing privileged access to the file system and ePHI. CISA published it as ICSMA-22-151-01 on May 31, 2022, affecting all versions of 16 BD products.

Is there a patch for the BD Pyxis default credentials issue?

No single patch is listed. BD service personnel are updating domain-joined server credentials with users and BD is piloting a credential management solution for specific Pyxis versions, per CISA advisory ICSMA-22-151-01 from May 31, 2022.

← Back to Vulnerabilities