Vulnerability

BD Synapsys sessions did not expire, risking changes to patient data

MedDevice Cyber Staff · May 31 · 2 min read · Via CISA ICSMA-22-151-02

CISA published advisory ICSMA-22-151-02 on May 31, 2022, covering CVE-2022-30277 in BD Synapsys versions 4.20, 4.20 SR1 and 4.30. BD disclosed it, on the same day as its Pyxis default credentials advisory.

The weakness is insufficient session expiration (CWE-613, CVSS v3 5.7). BD rated an unauthorized physical breach of a Synapsys workstation as negligible, because events must happen in a specific order. If they do, an attacker could modify ePHI, PHI or PII, and BD said the result could be delayed or incorrect treatment.

BD scheduled Synapsys 4.20 SR2 for June 2022 to remediate the flaw. Customers on 4.30 can upgrade to 5.10, expected by August 2022. BD's bulletin lists compensating controls until then.

Shared clinical workstations need short idle timeouts, and staff who walk away mid-session need a lock that does not depend on them remembering.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Install BD Synapsys 4.20 SR2, or move from 4.30 to 5.10. Until then, apply BD's compensating controls and enforce screen locks on Synapsys workstations so an unattended session cannot be reused.

Upgrade Synapsys. Install 4.20 SR2, or upgrade from 4.30 to 5.10.
Enforce workstation locks. Set short idle timeouts and screen locks on every Synapsys workstation.
Apply BD's compensating controls. Follow the controls in BD's Synapsys session expiration bulletin.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Handles patient data Patient or study database

BD Synapsys

PID-332 Handles patient data

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Dose IQ Safety Software	Baxter	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
CT Collaboration Live	Philips	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
Image Management V15	Philips	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
TipTraQ	Pranaq	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
ARIA Radiation Therapy Management	Varian	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
Assert-IQ (DM5000)	Abbott	Exposed to the same EMB3D threatTID-321	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer

28 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2022-30277 in BD Synapsys?

CVE-2022-30277 (CWE-613, CVSS v3 5.7) is insufficient session expiration in BD Synapsys 4.20, 4.20 SR1 and 4.30 that, after a physical breach of a workstation, could allow modification of ePHI, PHI or PII. CISA published it as ICSMA-22-151-02 on May 31, 2022.

Which BD Synapsys version fixes CVE-2022-30277?

BD planned Synapsys 4.20 SR2 for June 2022 to remediate CVE-2022-30277, with 4.30 users able to upgrade to 5.10 by August 2022, per CISA advisory ICSMA-22-151-02 from May 31, 2022.

← Back to Vulnerabilities