Vulnerability

BD Totalys MultiProcessor 1.70 and earlier uses hard-coded credentials

MedDevice Cyber Staff · Oct 4 · 2 min read · Via CISA ICSMA-22-277-01

CISA published advisory ICSMA-22-277-01 on October 4, 2022, covering CVE-2022-40263 in the BD Totalys MultiProcessor, versions 1.70 and earlier. BD disclosed the issue itself.

The product uses hard-coded credentials (CWE-798, CVSS v3 6.6). With them, an attacker could access, modify or delete sensitive information including ePHI, PHI and PII. The attacker needs physical or network access to the system and must get past any other security controls first, which is why the vector is local with low privileges.

BD scheduled the fix for software version 1.71, expected in the fourth quarter of 2022, and published compensating controls for sites still on the hard-coded credentials in its security bulletin.

A credential baked into the build cannot be rotated by the customer, so the only real defense until 1.71 lands is controlling who can reach the box at all.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade the BD Totalys MultiProcessor to software version 1.71 when BD delivers it. Until then, apply the compensating controls in BD's security bulletin and restrict physical and network access to the instrument, since the credentials cannot be changed by the user.

Schedule version 1.71. Work with BD to install the release that removes the hard-coded credentials.
Restrict physical and network access. Limit who can reach the instrument and its network segment, since exploitation requires one or the other.
Apply BD's compensating controls. Follow the controls listed in BD's Totalys MultiProcessor security bulletin for affected versions.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Handles patient data Hospital network

BD Totalys MultiProcessor

PID-332 Handles patient data User accounts

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2022-40263 in the BD Totalys MultiProcessor?

CVE-2022-40263 is a hard-coded credentials flaw (CWE-798, CVSS v3 6.6) in BD Totalys MultiProcessor versions 1.70 and earlier that could let an attacker access, modify or delete ePHI, PHI and PII. CISA published it as ICSMA-22-277-01 on October 4, 2022.

When is the BD Totalys MultiProcessor hard-coded credentials fix due?

BD said CVE-2022-40263 would be remediated in BD Totalys MultiProcessor software version 1.71, expected in the fourth quarter of 2022, per CISA advisory ICSMA-22-277-01 from October 4, 2022.

← Back to Vulnerabilities