Vulnerability

BD Pyxis MedStation ES and Pyxis Anesthesia ES kiosk mode can be escaped with physical access

MedDevice Cyber Staff · Mar 31 · 2 min read · Via CISA ICSMA-20-091-01

CISA published advisory ICSMA-20-091-01 on March 31, 2020, for CVE-2020-10598 in BD Pyxis MedStation ES and Pyxis Anesthesia (PAS) ES System, version 1.6.1. BD reported the issue. The weakness is a protection mechanism failure (CWE-693) with a CVSS v3 base score of 6.8.

Both products run their software in kiosk mode, a restricted desktop environment. Specially crafted inputs let a user escape that environment and reach sensitive data. CISA's risk evaluation says an attacker with physical access could bypass kiosk mode and view or modify sensitive data.

The CVSS vector is physical, with no privileges or user interaction required and high confidentiality, integrity and availability impact. Physical access is the only precondition.

BD said it was deploying a security update that strengthens kiosk mode against currently known escape methods in version 1.6.1, and that access to tools for viewing or manipulating local resources will be restricted. BD also published compensating controls in its product security bulletin.

Kiosk hardening is a contest against every dialog and shortcut the underlying desktop ships with, so the cabinet's own access controls carry as much weight as the shell.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD is deploying a security update that strengthens kiosk mode in Pyxis MedStation ES and Pyxis Anesthesia ES version 1.6.1 and restricts tools for viewing or manipulating local resources. Install it as BD rolls it out and apply the compensating controls in BD's product security bulletin. Physical access is the precondition, so limit unattended access to the stations.

Take the BD kiosk update. Coordinate with BD service to install the strengthened kiosk mode on every 1.6.1 station.
Apply BD's compensating controls. Follow the controls listed in the BD product security bulletin for this issue until the update is in place.
Limit unattended physical access. Place stations where use is observed and review access records for unusual sessions.
Test the shell during acceptance. Try known escape paths on any new kiosk build before it goes on the floor.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Pyxis MedStation ES System

PID-33

Pyxis Anesthesia (PAS) ES System

PID-33

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2020-10598 in BD Pyxis MedStation ES?

CVE-2020-10598 is a kiosk mode escape (CWE-693, CVSS v3 6.8) in BD Pyxis MedStation ES and Pyxis Anesthesia (PAS) ES System version 1.6.1. Specially crafted inputs let a user with physical access escape the restricted environment and view or modify sensitive data. CISA disclosed it in ICSMA-20-091-01 on March 31, 2020.

How is BD fixing the Pyxis MedStation ES kiosk escape?

BD said it is deploying a security update for Pyxis MedStation ES and Pyxis Anesthesia ES version 1.6.1 that strengthens kiosk mode against known escape methods for CVE-2020-10598 and restricts access to tools for viewing or manipulating local resources, per CISA advisory ICSMA-20-091-01.

← Back to Vulnerabilities