Vulnerability

Capsule Technologies SmartLinx Neuron 2 kiosk escapes to admin with a USB keyboard

MedDevice Cyber Staff · Jul 14 · 2 min read · Via CISA ICSMA-20-196-01

CISA published advisory ICSMA-20-196-01 on July 14, 2020, covering CVE-2019-5024 in Capsule Technologies SmartLinx Neuron 2, a medical information collection device. The advisory lists version 9.0.3 and prior as affected. Patrick DeSantis of Cisco Talos reported it.

The flaw is a restricted environment escape in the kiosk mode function (CWE-693, Protection Mechanism Failure). A specific series of keyboard inputs breaks out of the restricted environment and lands on the underlying operating system with full administrator access. The attacker only needs to plug a keyboard or other HID device into a USB port.

CISA rates it 7.6 under CVSS v3 and notes it is not exploitable remotely. The vector carries a scope change, and the risk evaluation explains why: a successful attacker gains full control of a trusted device on the hospital's internal network, and that device can then serve as a foothold.

Capsule Technologies published mitigations alongside the advisory. A kiosk that falls to a key sequence needs the same lockdown as an open admin console, because anyone in the room has a keyboard.

Are you a representative of Capsule Technologies? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the mitigations Capsule Technologies published with ICSMA-20-196-01 for SmartLinx Neuron 2 version 9.0.3 and prior; the advisory record names no fixed version. The attack needs a keyboard plugged into a USB port, so physical control of the device is the main compensating control.

Apply the Capsule mitigations. Follow the vendor mitigations listed in ICSMA-20-196-01 for Neuron 2 version 9.0.3 and prior.
Block casual USB access. Mount devices where patients and visitors cannot reach the USB ports, or use port blockers.
Watch the device on the network. A compromised Neuron 2 is a trusted host on the clinical network, so alert on traffic it does not normally send.
Disable escape paths in the kiosk shell. Device makers should strip OS shortcuts and run the kiosk under a non-admin account so a breakout gains nothing.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

USB port

Contributing

Hospital network

SmartLinx Neuron 2

PID-14 PID-23 USB port Hospital network

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
ID Now Instrument, ID Now Influenza A & B 2, ID NOW Strep A 2	Abbott	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
IonicRF Generator	Abbott	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
BD Alaris System with Guardrails Suite MX v12.1.2	BD	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
LabPro Data Management System	Beckman Coulter	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
LithoVue Elite Digital Flexible Ureteroscope System	Boston Scientific	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
DRX - Compass	Carestream Health	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Xpert C. difficile/Epi	Cepheid	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Ceribell Monitor	Ceribell	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Stelo Glucose Biosensor System	DexCom	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
FORE-SIGHT ELITE Absolute Tissue Oximeter	Edwards Lifesciences	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Monaco RTP System	Elekta	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer

46 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2019-5024 in Capsule Technologies SmartLinx Neuron 2?

CVE-2019-5024 (CVSS 7.6) is a kiosk mode escape in Capsule Technologies SmartLinx Neuron 2 version 9.0.3 and prior: a specific series of keyboard inputs via a USB keyboard or HID device gives full administrator access to the underlying operating system. CISA covered it in ICSMA-20-196-01 on July 14, 2020.

Can CVE-2019-5024 in the SmartLinx Neuron 2 be exploited remotely?

No. CISA advisory ICSMA-20-196-01 states the SmartLinx Neuron 2 kiosk escape is not exploitable remotely; the attacker must connect a keyboard or other HID device to a USB port. Success gives full control of a trusted device on the hospital's internal network.

← Back to Vulnerabilities