Vulnerability

BD patches KRACK Wi-Fi key reinstallation flaw across 12 Pyxis products

MedDevice Cyber Staff · Apr 24 · 3 min read · Via CISA ICSMA-18-114-01

CISA published advisory ICSMA-18-114-01 on April 24, 2018, covering the KRACK key reinstallation attacks in BD Pyxis products. Twelve product lines are listed, all versions, among them Pyxis MedStation ES, MedStation 4000 T2, Anesthesia System 3500 and 4000, Anesthesia ES, SupplyStation, StockStation and CIISafe.

The lead identifier is CVE-2017-13077 (CWE-323, CVSS v3 6.8), reinstallation of the pairwise key during the four-way handshake, with CVE-2017-13078 and CVE-2017-13079 in the same group. Mathy Vanhoef of imec-DistriNet, KU Leuven, found the KRACK flaws. Manipulated handshake traffic forces nonce reuse, and an attacker in radio range can then replay, decrypt or spoof frames.

KRACK is an industry-wide protocol weakness in WPA and WPA2. Every Wi-Fi client stack had to be patched, so medical devices inherited the problem from whatever wireless supplicant they ship. CISA says exploitation could allow partial disclosure of encrypted communication or injection of data.

BD has applied third-party vendor patches through its routine patch deployment process for most devices. Some need coordination with BD, and the company is contacting those users to schedule patches. BD reports no verified malicious exploitation of KRACK against its devices and published a product security bulletin with compensating controls.

A dispensing cabinet fleet is only as patched as its slowest coordinated install. Track which Pyxis units still wait on BD.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD has deployed third-party patches for the KRACK flaws to most Pyxis devices through its routine process; units that need coordination will be scheduled by BD. Confirm which of your Pyxis systems are patched and apply BD's compensating controls from its product security bulletin to the rest.

Inventory patch status. List every Pyxis unit on Wi-Fi and confirm with BD which have received the KRACK patches.
Schedule coordinated installs. Respond to BD's outreach for devices that need coordinated patch deployment.
Apply the bulletin's controls. Use the compensating controls in BD's KRACK product security bulletin on units still waiting.
Track the Wi-Fi supplicant. Keep the wireless client stack in the SBOM so protocol-level fixes reach the device quickly.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Off-the-shelf software Hospital network

BD Pyxis

Wireless connectivity Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which BD Pyxis products are affected by the KRACK vulnerability CVE-2017-13077?

CISA advisory ICSMA-18-114-01, published April 24, 2018, lists all versions of 12 BD Pyxis products, including Pyxis MedStation ES, MedStation 4000 T2, Anesthesia System 3500 and 4000, Anesthesia ES, SupplyStation, StockStation, SupplyRoller, PARx, ParAssist and CIISafe.

How is BD patching KRACK on Pyxis devices?

BD applies third-party vendor patches for the KRACK flaws (CVE-2017-13077 and related CVEs) through its routine patch deployment process. Some Pyxis devices need coordination, and BD is contacting those users to schedule patches, per CISA advisory ICSMA-18-114-01.

← Back to Vulnerabilities