Vulnerability

bioMérieux tells Windows 10 system users to install CryptoAPI fix for CVE-2020-0601

MedDevice Cyber Staff · Oct 14 · 2 min read · Via bioMérieux security advisories

bioMérieux posted an advisory, last updated October 14, 2020, on CVE-2020-0601, the critical Windows CryptoAPI spoofing flaw Microsoft disclosed on January 14, 2020. It recommends that customers with bioMérieux systems running Windows 10 or Windows Server 2016 install January's Windows security updates according to each system's instructions for use.

The flaw breaks how Windows verifies digital signatures. Malicious software, a website or an email can appear signed by a trusted authority, and an attacker can decrypt confidential data in transit.

Validated instrument workstations often take OS patches only after the vendor clears them. A manufacturer stating plainly that the update is approved removes the usual reason to wait.

Are you a representative of a manufacturer named here? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

bioMérieux systems running Windows 10 or Windows Server 2016 need Microsoft's January 2020 security updates for CVE-2020-0601. Install them following each system's instructions for use, and contact a local bioMérieux representative with questions.

Find the Windows hosts. List bioMérieux systems running Windows 10 or Windows Server 2016.
Install January 2020 updates. Apply Microsoft's January 2020 security updates per each system's instructions for use.
Confirm the patch level. Record the installed update on each system and recheck after any reimage.
Keep a patch cadence. Agree with bioMérieux on how later Windows security updates reach these systems.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity Gateway Suite	Dräger	Same named componentWindows Server (2016)	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same named componentWindows Server (2016)	No feedback feed from manufacturer

Questions & Answers

Which bioMérieux systems need the CVE-2020-0601 Windows update?

bioMérieux recommends that customers with bioMérieux systems running Windows 10 or Windows Server 2016 install Microsoft's January 2020 security updates for CVE-2020-0601, per its advisory last updated October 14, 2020.

What does CVE-2020-0601 let an attacker do?

CVE-2020-0601, the Windows CryptoAPI spoofing flaw disclosed January 14, 2020, can make malicious software, a website or an email appear signed by a trusted authority and can let an attacker decrypt data in transit, bioMérieux says.

← Back to Vulnerabilities