Vulnerability

BeaconMedaes TotalAlert Scroll Medical Air Systems expose stored passwords to unauthenticated users

MedDevice Cyber Staff · May 24 · 2 min read · Via CISA ICSMA-18-144-01

CISA published advisory ICSMA-18-144-01 on May 24, 2018, for BeaconMedaes TotalAlert Scroll Medical Air Systems running version 4107600010.23 and prior. Maxim Rupp reported the two vulnerabilities. Both score 7.5 under CVSS v3, reachable over the network with no privileges and no user interaction.

CVE-2018-7518 (CWE-284) lets an attacker with network access to the integrated web server retrieve default or user-defined credentials that are stored and transmitted in an insecure manner. CVE-2018-7510 (CWE-522) is blunter: passwords sit in plaintext in a file that anyone can read without authentication.

CISA's risk evaluation limits the damage to viewing and possibly modifying some device information and web application setup data. BeaconMedaes stated that a successful attacker could not affect the system's ability to deliver medical air in compliance with the NFPA 99 standard, and that patient health information is not exposed.

The fix is update 4107600010.24, which users obtain by calling BeaconMedaes at 1-888-4MEDGAS (463-3427). An embedded web server on facility infrastructure is still a foothold on the hospital network even when the air keeps flowing, so the passwords it leaked should be treated as burned.

Are you a representative of BeaconMedaes? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update TotalAlert Scroll Medical Air Systems to 4107600010.24 or the latest release, obtained from BeaconMedaes at 1-888-4MEDGAS (463-3427). Versions 4107600010.23 and prior store credentials in plaintext readable without authentication. Change every password on the unit after updating and keep its web server off general networks.

Install update 4107600010.24. Contact BeaconMedaes for the update and apply it to every TotalAlert Scroll Medical Air System at 4107600010.23 or earlier.
Reset all credentials. Assume default and user-defined passwords were readable and replace them once the update is in place.
Restrict the web server. Allow access to the integrated web server only from the facilities management hosts that need it.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts Web interface

Contributing

Wired network Hospital network

TotalAlert Scroll Medical Air Systems

PID-311 PID-3321 Web interface User accounts

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Aperio GT 450 DX	Leica Biosystems	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer

13 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

How do I fix CVE-2018-7510 in BeaconMedaes TotalAlert Scroll Medical Air Systems?

Install BeaconMedaes update 4107600010.24 or the latest release, available by calling BeaconMedaes at 1-888-4MEDGAS (463-3427). CISA advisory ICSMA-18-144-01, published May 24, 2018, lists versions 4107600010.23 and prior as affected by CVE-2018-7510 and CVE-2018-7518.

Can the BeaconMedaes TotalAlert vulnerabilities stop medical air delivery?

BeaconMedaes stated that exploiting CVE-2018-7518 or CVE-2018-7510 in the TotalAlert Scroll Medical Air Systems would not affect delivery of medical air in compliance with NFPA 99, per CISA advisory ICSMA-18-144-01. An attacker could view and potentially modify some device information and web application setup data.

← Back to Vulnerabilities