Vulnerability

bioMérieux says three Access:7 flaws reach VILINK with Axeda, rated low risk behind the firewall

MedDevice Cyber Staff · Mar 8 · 3 min read · Via bioMérieux security advisories

bioMérieux updated its Access:7 advisory on March 8, 2022 for seven vulnerabilities in PTC's Axeda agent and Axeda Desktop Server, CVE-2022-25246 to CVE-2022-25252. The Axeda components run inside VILINK with Axeda, the company's remote access, proactive maintenance and remote update service.

Three of the seven apply. CVE-2022-25251, scored 9.8, lets a remote unauthenticated attacker read and modify the agent configuration by sending XML messages to a port; bioMérieux gives it a contextualized environmental score of 6.4. CVE-2022-25250 and CVE-2022-25252, both 7.5, allow a service shutdown and a crash, and drop to 2.3 in the company's scoring.

The reduction rests on the Windows Firewall, which bioMérieux enables by default and which blocks TCP ports 3031 and 3011. If the firewall has been disabled or altered from its default state, the 9.8 stands for CVE-2022-25251 and the other two rise to 5.7. The remaining four CVEs, including the hardcoded UltraVNC credentials of CVE-2022-25246, do not apply because bioMérieux removed those credentials and does not run the affected server components in VILINK.

VILINK is not a medical device, bioMérieux notes, and VILINK with Securelink is not affected. Its environmental scoring is a sound model for vendor triage, provided someone on site confirms the firewall the math depends on is still on.

Are you a representative of bioMérieux? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Three Access:7 flaws, CVE-2022-25251, CVE-2022-25250 and CVE-2022-25252, apply to VILINK with Axeda but are low risk while the default Windows Firewall blocks TCP ports 3031 and 3011. bioMérieux gives no patched VILINK version and tells customers to keep the firewall enabled and check the advisory for updates.

Verify the firewall. Confirm Windows Firewall is enabled at factory settings on every bioMérieux system running VILINK with Axeda.
Check the blocked ports. Make sure TCP ports 3031 and 3011 stay blocked inbound on those systems.
Watch for updates. Recheck the bioMérieux Access:7 advisory for remediation of the three applicable CVEs.
Consider Securelink. Ask bioMérieux whether VILINK with Securelink, which is not affected, is available for your systems.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Remote access Off-the-shelf software

Contributing

Named operating system

VILINK with Axeda

PID-331 PID-275 Remote access Off-the-shelf software Named operating system

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Access:7 vulnerabilities affect bioMérieux VILINK with Axeda?

bioMérieux said on March 8, 2022 that CVE-2022-25251, CVE-2022-25250 and CVE-2022-25252 apply to VILINK with Axeda, while CVE-2022-25246, CVE-2022-25247, CVE-2022-25248 and CVE-2022-25249 do not.

Why does bioMérieux rate CVE-2022-25251 lower than 9.8 for VILINK?

bioMérieux gives CVE-2022-25251 a contextualized score of 6.4 because its systems ship with the Windows Firewall on and TCP port 3031 blocked; if the firewall is disabled or altered, the 9.8 base score remains.

Is VILINK with Securelink affected by Access:7?

No. bioMérieux said in its March 8, 2022 Access:7 advisory that VILINK with Securelink is not affected by the Axeda vulnerabilities CVE-2022-25246 to CVE-2022-25252.

← Back to Vulnerabilities