Vulnerability

BD Viper LT system uses hard-coded credentials that expose patient data

MedDevice Cyber Staff · Mar 3 · 2 min read · Via CISA ICSMA-22-062-02

CISA published advisory ICSMA-22-062-02 on March 3, 2022, for the BD Viper LT system, Version 2.0 and later. BD reported the issue itself.

CVE-2022-22765 (CWE-798) is the use of hard-coded credentials, scored CVSS v3 8.0. A threat actor could use them to access, modify or delete sensitive information, including ePHI, PHI and personally identifiable information. The vector is local with no privileges or user interaction required, so the attacker needs to reach the system itself.

Hard-coded credentials are the same on every unit and cannot be changed by the customer. Once known, they work everywhere the product is installed, and they stay valid until the vendor ships new code.

BD is working on a remediation and expects it in the upcoming BD Viper LT system Version 4.80 software release. Until then it recommends compensating controls, detailed in its product security bulletin, for users of systems that use the hard-coded credentials.

Disclosing before the patch is ready lets operators put physical and access controls in place now. A shared password across a whole install base is a design flaw that only a code change ends.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch yet: BD expects to fix CVE-2022-22765 in BD Viper LT system Version 4.80. Until it ships, apply the compensating controls in BD's product security bulletin and limit who can physically and locally reach Viper LT systems.

Apply BD's compensating controls. Follow the BD product security bulletin for Viper LT systems that use the hard-coded credentials.
Restrict local access. Limit physical and local access to Viper LT systems to authorized laboratory staff.
Plan the 4.80 upgrade. Schedule BD Viper LT Version 4.80 as soon as BD releases it.
Provision unique credentials. Ship each unit with credentials that differ per device and can be changed by the customer.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Handles patient data

BD Viper LT system

Handles patient data

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
CT Collaboration Live	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Image Management V15	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ARIA Radiation Therapy Management System	Varian	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

Questions & Answers

What is CVE-2022-22765 in the BD Viper LT system?

CVE-2022-22765 is a hard-coded credentials flaw (CWE-798, CVSS v3 8.0) in the BD Viper LT system Version 2.0 and later that could let a threat actor access, modify or delete ePHI, PHI and PII. CISA published advisory ICSMA-22-062-02 on March 3, 2022.

When will BD fix the Viper LT hard-coded credentials?

BD expects to fix CVE-2022-22765 in the upcoming BD Viper LT system Version 4.80 software release and recommends compensating controls until then, per CISA advisory ICSMA-22-062-02.

← Back to Vulnerabilities