Vulnerability

Beckman Coulter maps PrintNightmare print spooler flaws across its lab instrument line

MedDevice Cyber Staff · Aug 13 · 3 min read · Via Beckman Coulter PrintNightmare security information

Beckman Coulter published PrintNightmare guidance on August 13, 2021 for the critical Windows Print Spooler remote code execution flaw CVE-2021-34527 and the related CVE-2021-36947, CVE-2021-36936, CVE-2021-34483 and CVE-2021-34481. Microsoft patched them, and they affect all Windows operating systems.

The product list runs long: Access 2, UniCel DxI 600 and 800, the AU models (DxC700AU, AU480, AU680, AU5800), PK7400, PK7300, DxONE Command Central, REMISOL ADVANCE, DxH 600, 800, 900 and 690T with SMS and SMS II, the LH series, iRICELL, iQ200, Power Express, AutoMate 1200 to 2550, DxA 5000 and LabPro computers, among others. Beckman Coulter evaluated the risk for each and gives product-specific patch, mitigation or customer-action guidance. The page was last updated on July 13, 2023.

A print service on an analyzer that never prints is pure attack surface. Disable the spooler wherever the guidance allows.

Are you a representative of Beckman Coulter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Beckman Coulter instruments built on Windows are exposed to CVE-2021-34527 and four related Print Spooler CVEs. Apply the product-specific patch or mitigation from Beckman Coulter's PrintNightmare page for each model. Where an instrument does not need to print, the spooler should be off.

Pull the per-product guidance. Match each installed instrument to its entry on Beckman Coulter's PrintNightmare page and apply the stated patch or mitigation.
Disable unneeded spoolers. Turn off the Print Spooler service on instruments that have no printing role, within Beckman Coulter's guidance.
Block inbound remote printing. Deny inbound print traffic to instrument PCs at the lab segment boundary.
Record the result. Log which instruments were patched, mitigated or left for customer action so the next Windows advisory starts from a known state.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Wired network Hospital network

Access 2

Named operating system

UniCel DxI

Named operating system

AU chemistry analyzers

Named operating system

DxH

Named operating system

AutoMate

Named operating system

DxA 5000

Named operating system

DxONE Command Central

Named operating system

REMISOL ADVANCE

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Beckman Coulter instruments are affected by PrintNightmare CVE-2021-34527?

Beckman Coulter's August 13, 2021 notice lists instruments including Access 2, UniCel DxI 600 and 800, AU models, DxH 600/800/900/690T, AutoMate, Power Express, DxA 5000, DxONE Command Central, REMISOL ADVANCE and LabPro computers, with product-specific guidance for each.

What does Beckman Coulter recommend for the Windows Print Spooler vulnerability?

For CVE-2021-34527 and related CVEs, Beckman Coulter evaluated each product and provides product-specific patch, mitigation or customer-action guidance on its PrintNightmare page, first published August 13, 2021.

← Back to Vulnerabilities