Vulnerability

Boston Scientific ZOOM LATITUDE PRM Model 3120 accepts unsigned software from USB and can be re-regioned

MedDevice Cyber Staff · Sep 30 · 4 min read · Via CISA ICSMA-21-273-01

CISA published advisory ICSMA-21-273-01 on September 30, 2021, covering five vulnerabilities in the Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor (PRM) Model 3120. The researchers are Endres Puschner of the Max Planck Institute for Security and Privacy in Bochum, Christoph Saatjohann and Christian Dresen of FH Münster University of Applied Sciences, and Markus Willing of the University of Muenster.

Every flaw needs physical access. CVE-2021-38400 (CWE-916, CVSS v3 6.9) lets an attacker pull the hard disk drive or use a crafted USB to extract the password hash and brute force the system password. CVE-2021-38396 (CWE-353, 6.5) is the most direct: the installation utility performs no cryptographic authenticity or integrity check of software on the flash drive, so a crafted USB installs unauthorized software.

The other three widen the reach. CVE-2021-38392 (CWE-284, 6.5) lets a skilled attacker edit the hard disk to change the telemetry region, then interrogate or program an implantable device in any region in the world. CVE-2021-38394 (CWE-1278, 6.2) allows the binary that checks the hardware key to be reverse engineered and a duplicate key built, which opens access to special settings. CVE-2021-38398 (CWE-1329, 6.5) covers unpatched off-the-shelf software components.

CISA notes the PRM is not network connected and has no hardware to be. That keeps the scores in the 6 range. It does nothing for a unit that leaves the clinic for service or disposal.

Boston Scientific will not issue a product update for the Model 3120 and is moving all users to the LATITUDE Programming System, Model 3300. A programmer that talks to implants and installs whatever is on a USB stick needs to be locked in a cabinet until it is retired.

Are you a representative of Boston Scientific? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch: Boston Scientific will not issue a product update for the ZOOM LATITUDE PRM Model 3120. Move to the replacement LATITUDE Programming System, Model 3300. Until each unit is retired, keep it under strict physical control and apply the compensating measures Boston Scientific lists in ICSMA-21-273-01.

Transition to the Model 3300. Work with Boston Scientific to replace every Model 3120 with the LATITUDE Programming System, Model 3300.
Secure the programmers physically. All five CVEs need physical access, so store units where hard drives and USB ports cannot be reached unobserved.
Control USB media. Allow only Boston Scientific-supplied media near the programmer, since the installer does not verify software.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Field-updatable firmware

Contributing

USB port Off-the-shelf software Handles patient data

ZOOM LATITUDE Programmer/Recorder/Monitor (PRM)

PID-271 PID-14 PID-3321 USB port Off-the-shelf software Handles patient data Field-updatable firmware

Fix the class in your product

The updater does not verify who it talks to or what it installs. As the maker, verify the server certificate and a cryptographic signature on the payload against a device-provisioned key before anything is written. Transport and payload signing are separate controls, and you need both.

Sign the payload. Verify a signature against a key provisioned on the device; refuse unsigned or tampered images.
Verify the server. Validate the full TLS chain and reject a mismatch rather than proceeding.
Block rollback. Refuse downgraded images so an attacker cannot force a known-vulnerable version.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
ID Now Instrument, ID Now Influenza A & B 2, ID NOW Strep A 2	Abbott	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
IonicRF Generator	Abbott	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Welch Allyn Connex Spot Monitor; 901058 Vital Signs Monitor Core	Baxter	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
BD Alaris System with Guardrails Suite MX v12.1.2	BD	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Ceribell Monitor	Ceribell	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
FORE-SIGHT ELITE Absolute Tissue Oximeter	Edwards Lifesciences	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Agilia VP Infusion System	Fresenius Kabi	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Sonosite LX Ultrasound System	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Carescape Canvas 1000; Carescape Canvas Smart Display	GE HealthCare	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
CARESCAPE ONE and CARESCAPE DOCK F0	GE HealthCare	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
CARESCAPE ONE and CARESCAPE DOCK FO	GE HealthCare	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
LOGIQ e	GE HealthCare	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer

27 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

Will Boston Scientific fix CVE-2021-38396 in the ZOOM LATITUDE PRM Model 3120?

No. Per CISA advisory ICSMA-21-273-01, published September 30, 2021, Boston Scientific will not issue a product update for the ZOOM LATITUDE PRM Model 3120 and is transitioning users to the LATITUDE Programming System, Model 3300. CVE-2021-38396 lets a crafted USB install unauthorized software.

Can the Boston Scientific ZOOM LATITUDE programmer be hacked over the network?

No. CISA advisory ICSMA-21-273-01 states the ZOOM LATITUDE PRM Model 3120 is not network connected and contains no hardware to be. All five vulnerabilities, CVE-2021-38392, CVE-2021-38394, CVE-2021-38396, CVE-2021-38398 and CVE-2021-38400, require physical access.

What does CVE-2021-38392 allow on the Boston Scientific Model 3120?

CVE-2021-38392 lets a skilled attacker with physical access change the telemetry region on the ZOOM LATITUDE PRM Model 3120 hard disk and use it to interrogate or program an implantable device in any region in the world, per CISA advisory ICSMA-21-273-01. It scores 6.5 under CVSS v3.

← Back to Vulnerabilities