Vulnerability

BIOTRONIK CardioMessenger II-S home monitors store recoverable credentials and leak them in cleartext

MedDevice Cyber Staff · Jun 18 · 4 min read · Via CISA ICSMA-20-170-05

CISA published advisory ICSMA-20-170-05 on June 18, 2020, for the BIOTRONIK CardioMessenger II-S, GSM and T-Line models running T4APP 2.2. Guillaume Bour, Anniken Wium Lie and Marie Moe reported five vulnerabilities. The CardioMessenger is the home monitoring unit that collects data from a patient's implanted cardiac device and forwards it to BIOTRONIK's Remote Communication infrastructure.

Three are about how the unit talks to that infrastructure, each scored CVSS v3 4.3 with adjacent access required. CVE-2019-18246 (CWE-287): the unit does not properly enforce mutual authentication. CVE-2019-18248 (CWE-319): it sends credentials in cleartext before switching to an encrypted channel. CVE-2019-18252 (CWE-287): the same credentials serve more than one authentication purpose, so an adjacent attacker can disclose them.

The other two need physical access and score 4.6. CVE-2019-18254 (CWE-311) is unencrypted data at rest, which exposes medical measurement data and the serial number of the paired implant. CVE-2019-18256 (CWE-257) covers per-device credentials stored in a recoverable format, usable for network authentication and for decrypting local data in transit.

Per CISA, an attacker with physical access could also obtain transmitted medical data from implanted cardiac devices if they know the implant's serial number, or impair the CardioMessenger. An attacker with adjacent access could influence traffic between the unit and the APN gateway network.

BIOTRONIK said it will not issue a product security update. It reported compensating controls already in place on its side that reduce exploitation risk and prevent patient safety risks, and said its assessment found no new potential safety risks. Users are asked to take defensive measures of their own.

Per-device credentials were the right design choice; storing them recoverably and sending them in the clear before TLS came up undid it. Credentials on a home unit need hardware-backed storage, because the attacker can own the box.

Are you a representative of BIOTRONIK? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch: BIOTRONIK will not issue a CardioMessenger II-S security update and relies on server-side compensating controls. Patients and clinics should keep units in the patient's home and under the patient's control, and follow BIOTRONIK's defensive measures. Report lost or tampered units to BIOTRONIK so their credentials can be handled.

Keep units physically secure. Physical access defeats CVE-2019-18254 and CVE-2019-18256, so the CardioMessenger should stay in the patient's home.
Follow BIOTRONIK's measures. Apply the defensive measures BIOTRONIK listed for users in the advisory.
Report lost units. Tell BIOTRONIK when a CardioMessenger is lost, resold or returned so its credentials are not reused.
Protect secrets in hardware. Home monitors should keep per-device credentials in a secure element and authenticate the server before sending anything.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Remote access

Contributing

Home use Handles patient data Wireless connectivity

CardioMessenger II-S

Remote access Home use Handles patient data

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
ProBeam 360 Proton Therapy System v3.0	Varian	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Assert-IQ Insertable Cardiac Monitor	Abbott	Same signals	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Same signals	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer

Questions & Answers

Will BIOTRONIK patch the CardioMessenger II-S vulnerabilities?

No. BIOTRONIK said it will not issue a product security update for CVE-2019-18246, CVE-2019-18248, CVE-2019-18252, CVE-2019-18254 and CVE-2019-18256 in CardioMessenger II-S GSM and T-Line T4APP 2.2, per CISA advisory ICSMA-20-170-05 of June 18, 2020. It relies on compensating controls it has put in place.

What data can be taken from a BIOTRONIK CardioMessenger II-S?

Per CISA advisory ICSMA-20-170-05, an attacker with physical access to a CardioMessenger II-S on T4APP 2.2 can disclose medical measurement data and the serial number of the paired implanted cardiac device (CVE-2019-18254), and recover stored per-device credentials (CVE-2019-18256).

Who found the BIOTRONIK CardioMessenger vulnerabilities?

Guillaume Bour, Anniken Wium Lie and Marie Moe reported the five CardioMessenger II-S vulnerabilities disclosed in CISA advisory ICSMA-20-170-05 on June 18, 2020.

← Back to Vulnerabilities

Key Facts

Target Product: CardioMessenger II-S GSM T4APP 2.2; T-Line T4APP 2.2 (BIOTRONIK)
Device Type: Implant home monitoring unit
Material: T4APP = 2.2
Components: Generic Hardware, Cloud Service, Platform
Interface: TLS
Dataflows: CardioMessenger to BIOTRONIK Remote Communication infrastructure (patient implant data); Implanted cardiac device to CardioMessenger (medical data); CardioMessenger to APN gateway network
Assets: Per-device credentials stored in recoverable format (Credentials); Medical measurement data and paired implant serial number (unencrypted at rest) (Patient Data); Credentials reused for more than one authentication purpose (Credentials)
Advisory: ICSMA-20-170-05
CVEs: CVE-2019-18246, CVE-2019-18248, CVE-2019-18252, CVE-2019-18254, CVE-2019-18256
CVSS: 4.3 (v3)
Severity: Medium
Disclosed: Jun 18, 2020
Source: CISA ICSMA-20-170-05

Sources

BIOTRONIK: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: BIOTRONIK