Vulnerability

BD lists 19 Pyxis, Parata and CCE products as affected by ESET flaw CVE-2024-0353

MedDevice Cyber Staff · Mar 29 · 3 min read · Via BD bulletin: Third-Party Vulnerability ESET Privilege Escalation

BD published a third-party vulnerability bulletin on March 29, 2024 for CVE-2024-0353, a flaw in ESET's real-time file system protection on Windows. A low-privileged attacker could use it to delete arbitrary files with SYSTEM privileges. BD lists 19 products, among them the Pyxis Medstation 4000 and ES, Pyxis Anesthesia Station 4000 and ES, Pyxis CIISafe, Pyxis Enterprise Server, the BD Care Coordination Engine and the Parata IntelliCab and IntelliVault systems.

An update was made available for BD-managed products, and BD reports no known exploitation. Arbitrary file deletion as SYSTEM is a privilege escalation primitive: an attacker who removes the right file can often plant a replacement.

The endpoint protection agent runs with the highest privileges on the box, so its bugs become the box's bugs. Track it in the SBOM like any other component.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD made an ESET update available for BD-managed products on or before its March 29, 2024 bulletin. Operators should confirm the update landed on every listed Pyxis, Parata and CCE system. Customer-managed hosts need the ESET update applied through normal channels.

Confirm the ESET update. Check that each listed BD system runs the updated ESET build referenced in the March 29, 2024 bulletin.
Limit local accounts. Remove low-privileged interactive logins that are not needed on dispensing cabinets and servers.
List the security agent in the SBOM. Treat endpoint protection software as a tracked third-party component with its own patch cadence.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system Off-the-shelf software

Pyxis Medstation

Off-the-shelf software Named operating system

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

Which BD products are affected by ESET CVE-2024-0353?

BD's March 29, 2024 bulletin lists 19 products affected by ESET CVE-2024-0353, including Pyxis Medstation 4000 and ES, Pyxis Anesthesia Station 4000 and ES, Pyxis CIISafe, Pyxis Enterprise Server, BD Care Coordination Engine and Parata IntelliCab and IntelliVault.

Is there a fix for CVE-2024-0353 on BD Pyxis systems?

Yes. BD's March 29, 2024 bulletin says an update for the ESET CVE-2024-0353 file deletion flaw was made available for BD-managed products, and BD knows of no exploitation.

← Back to Vulnerabilities