Vulnerability

Boston Scientific ZOOM LATITUDE PRM uses a hard-coded key and leaves patient data unencrypted

MedDevice Cyber Staff · Oct 19 · 2 min read · Via CISA ICSMA-17-292-01

CISA published advisory ICSMA-17-292-01 on October 19, 2017, covering the Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor (PRM) Model 3120. All versions are affected by two vulnerabilities, each scored 4.6 under CVSS v3.

CVE-2017-14014 (CWE-321) is a hard-coded cryptographic key. The PRM uses it to encrypt PHI before writing it to removable media, so anyone who recovers the key from one unit can decrypt exports from every unit. CVE-2017-14012 (CWE-311) is simpler: the device does not encrypt PHI at rest at all.

Both CVSS vectors start with physical access. An attacker has to hold the programmer or the media it wrote, which keeps the scores low and the exposure tied to loss, theft and disposal rather than network attack. A programmer that leaves a clinic for repair or resale carries its patient records with it.

Boston Scientific said it will not issue a product update for the Model 3120 and pointed users to compensating controls. Physical custody of the programmer and its media is the only control left, so treat both like a paper chart.

Are you a representative of Boston Scientific? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch: Boston Scientific will not issue a product update for the ZOOM LATITUDE PRM Model 3120. Control physical access to the programmer and to any removable media it writes, and wipe or destroy media and units at end of use. Apply the compensating controls Boston Scientific recommends in ICSMA-17-292-01.

Lock down the programmers. Store Model 3120 units in controlled areas and track who signs them out.
Control exported media. Treat removable media written by the PRM as readable PHI, since the encryption key is the same on every unit.
Sanitize before disposal or repair. Remove patient data from the programmer and its media before a unit leaves your custody.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Handles patient data

Contributing

Removable media

ZOOM LATITUDE Programmer/Recorder/Monitor (PRM)

Removable media Handles patient data

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
IonicRF Generator	Abbott	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Versana Active	GE HealthCare	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Versana Premier	GE HealthCare	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Endoflip 300 System	Medtronic	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Evis EUS Endoscopic Ultrasound Center Olympus EU-ME3	Olympus	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Optomed Smartscope M5 with Optomed Smartscope FA	Optomed	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Zenition 70	Philips	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Zenition 90	Philips	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer

4 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

Will Boston Scientific patch CVE-2017-14014 in the ZOOM LATITUDE PRM Model 3120?

No. CISA advisory ICSMA-17-292-01, published October 19, 2017, states Boston Scientific will not issue a product update for the hard-coded cryptographic key (CVE-2017-14014) or the unencrypted PHI at rest (CVE-2017-14012) in any version of the ZOOM LATITUDE PRM Model 3120. It recommends compensating controls.

Can someone read patient data from a Boston Scientific ZOOM LATITUDE programmer?

Per CISA advisory ICSMA-17-292-01, the ZOOM LATITUDE PRM Model 3120 does not encrypt PHI at rest (CVE-2017-14012) and encrypts PHI exported to removable media with a hard-coded key (CVE-2017-14014). Both require physical access and score 4.6 under CVSS v3.

← Back to Vulnerabilities