Vulnerability

BD Pyxis dispensing and supply systems ship with hard-coded credentials across 24 products

MedDevice Cyber Staff · Mar 3 · 3 min read · Via CISA ICSMA-22-062-01

CISA published advisory ICSMA-22-062-01 on March 3, 2022, for CVE-2022-22766, hard-coded credentials (CWE-798) across BD's Pyxis line. The advisory lists 24 products at all versions, among them Pyxis MedStation ES, MedStation 4000, Anesthesia Station ES and 4000, CIISafe, SupplyStation, ProcedureStation and the Rowa Pouch Packaging Systems. BD reported the issue, and the CVSS v3 base score is 7.0.

The credentials may let threat actors reach the underlying file system and mine application files for information that could decrypt application credentials or expose electronic protected health information (ePHI). BD manages the credentials, and customers neither see them nor use them to operate the devices.

The vector is local with high attack complexity and low privileges required. Once an attacker holds the credentials, CISA rates confidentiality, integrity and availability impact all high.

BD said it is strengthening credential management capabilities in Pyxis devices and recommended compensating controls for products that use the hard-coded credentials, documented in its security bulletin.

A secret shared across two dozen product lines is only as safe as the least protected unit that carries it, and customers who cannot see it cannot rotate it.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no fixed version yet: BD is strengthening credential management in Pyxis devices. Apply the compensating controls in BD's bulletin for every affected Pyxis and Rowa product. Because the credentials are BD managed, customers cannot rotate them and should focus on limiting who can reach the devices locally.

Apply BD's compensating controls. Follow the controls in the BD Pyxis hard-coded credentials bulletin for each of the 24 listed products.
Limit local and network access. Restrict who can log on to or reach Pyxis devices, since the attack needs local access with low privileges.
Track BD's credential update. Ask the BD service representative when strengthened credential management reaches your installed versions.
Design out shared secrets. Device makers should provision per-unit credentials that the operator can rotate.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Handles patient data

BD Pyxis

PID-3321 Handles patient data User accounts

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
CT Collaboration Live	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Image Management V15	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ARIA Radiation Therapy Management System	Varian	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

Questions & Answers

What is CVE-2022-22766 in BD Pyxis products?

CVE-2022-22766 (CWE-798, CVSS v3 7.0) is the use of hard-coded, BD-managed credentials in all versions of 24 BD Pyxis products and the BD Rowa Pouch Packaging Systems. It may allow access to the underlying file system and to ePHI. CISA disclosed it in ICSMA-22-062-01 on March 3, 2022.

Can hospitals change the hard-coded credentials in BD Pyxis MedStation ES?

No. BD states the CVE-2022-22766 credentials are BD managed and are not visible to or used by customers. BD is strengthening credential management in Pyxis devices and recommends compensating controls, per CISA advisory ICSMA-22-062-01.

← Back to Vulnerabilities