Vulnerability

BPL PWS-01-BT weighing scale sends unencrypted, unauthenticated BLE data to the Be Well app

MedDevice Cyber Staff · Sep 10 · 2 min read · Via CISA ICSMA-24-254-01

CISA published advisory ICSMA-24-254-01 on September 10, 2024, for CVE-2024-34463 in BPL Medical Technologies' PWS-01-BT personal weighing scale, all versions, and its Be Well Android application, version 3.64 and earlier. Yash Chandna and Hanit Thakur reported it. The advisory covers the scale and its Be Well Android application together.

The weakness is cleartext transmission of sensitive information (CWE-319), CVSS v3.1 4.6. The scale sends sensitive information in unencrypted BLE packets, and the packet data also lacks authentication and integrity protection. An attacker on the adjacent radio link could intercept and modify the information as it is processed.

BPL Medical Technologies has not responded to requests to work with CISA to mitigate the issue, and the advisory lists no fix. CISA notes the vulnerability is not exploitable remotely and that no known public exploitation had been reported.

Unauthenticated BLE packets let a nearby attacker change a reading as easily as read it, and a scale feeding a health app produces data people act on.

Are you a representative of BPL Medical Technologies? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch: BPL Medical Technologies has not responded to CISA and the advisory lists no fix for the PWS-01-BT scale or the Be Well Android app. Users should contact BPL support. The attack needs radio proximity, so readings taken where others are nearby should be double-checked before anyone acts on them.

Contact BPL support. Ask BPL Medical Technologies about a fix for the PWS-01-BT and Be Well app 3.64 and earlier.
Verify readings that matter. Confirm any weight reading used for a clinical decision on a second instrument.
Encrypt and authenticate BLE in new designs. Device makers should use BLE pairing with encryption and message authentication for every measurement packet.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Mobile app Home use

PWS-01-BT

PID-4112 PID-4111 Wireless connectivity Mobile app

Be Well Android Application

Mobile app

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same platformAndroid	No feedback feed from manufacturer
FreeStyle Libre 2 Flash Glucose Monitoring System	Abbott	Same platformAndroid	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same platformAndroid	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same platformAndroid	No feedback feed from manufacturer
TipTraQ	Pranaq	Same platformAndroid app	No feedback feed from manufacturer
All-Day Clear Slim ADCS1 Hearing Aid. All-Day Clear ADC1 Hearing Aid	Sonova	Same platformAndroid	No feedback feed from manufacturer
t:slim X2 insulin pump with interoperable technology	Tandem Diabetes Care	Same platformAndroid app	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Same platformAndroid	No feedback feed from manufacturer
WSA Self-Fitting Hearing Aid Gen 2	WS Audiology	Same platformAndroid	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Same attributes (interface and component types)BLE, Mobile Application	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same signals	No feedback feed from manufacturer
Portrait Mobile Monitoring Solution consists of: • Portrait Central	GE HealthCare	Same signals	No feedback feed from manufacturer
Zio AT device	iRhythm	Same signals	No feedback feed from manufacturer
MULTIX Impact E	Siemens Healthineers	Same signals	No feedback feed from manufacturer
Connected OR Hub with Device and Voice Control	Stryker	Same signals	No feedback feed from manufacturer

1 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2024-34463 in the BPL PWS-01-BT weighing scale?

CVE-2024-34463 (CWE-319, CVSS v3.1 4.6) means the BPL Medical Technologies PWS-01-BT personal weighing scale sends sensitive information in unencrypted BLE packets that also lack authentication and integrity protection, affecting the Be Well Android app 3.64 and earlier. CISA disclosed it in ICSMA-24-254-01 on September 10, 2024.

Has BPL Medical Technologies released a fix for CVE-2024-34463?

No. CISA advisory ICSMA-24-254-01 says BPL Medical Technologies has not responded to requests to work with CISA to mitigate CVE-2024-34463 in the PWS-01-BT scale and Be Well Android application, and users are encouraged to contact BPL support.

← Back to Vulnerabilities