Vulnerability

Carestream DRX wireless detectors affected by KRACK WPA2 key reinstallation flaws

MedDevice Cyber Staff · Nov 1 · 2 min read · Via Carestream advisory CARESTREAM-XRS-2017-01

Carestream Health published advisory CARESTREAM-XRS-2017-01 on November 1, 2017 on the Wi-Fi Protected Access key reinstallation attack, KRACK, tracked as CVE-2017-13077 through CVE-2017-13088. An attacker in Wi-Fi range could eavesdrop on or alter communications.

Affected products are the DRX-Evolution and DRX-Ascend with DRX-1 or DRX-Plus wireless detectors, the DRX-Innovation and DRX-Excel with DRX-Plus detectors, all models of the DRX-1 System, DRX-Revolution, DRX-Mobile Retrofit and DRX-Transportable, and Image Suite with DRX-1 or DRX-Plus detectors. The detectors talk over the DRX private network, and Carestream rates the risk low with no PHI carried.

Carestream is preparing detector patches and access point firmware updates. Carestream is fixing both ends of the link, so schedule the detector and access point updates together.

Are you a representative of Carestream Health? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Carestream is preparing detector patches and access point firmware for the KRACK flaws on DRX wireless detectors. Install both together when released. Until then keep the DRX private network separate from other wireless traffic.

Patch detectors and access points. Apply Carestream's detector patches and access point firmware together once released.
Keep the DRX network private. Confirm the DRX wireless network carries only detector traffic and is not bridged to the hospital network.
Watch the RF perimeter. Treat unexplained access points near imaging rooms as a finding until the fixes are in.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

DRX-1 and DRX-Plus wireless detectors

PID-4113 Wireless connectivity

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Questions & Answers

Are Carestream DRX wireless detectors vulnerable to KRACK?

Yes. Carestream advisory CARESTREAM-XRS-2017-01, published November 1, 2017, lists DRX systems using DRX-1 and DRX-Plus wireless detectors on the DRX private network as affected by the KRACK WPA2 flaws, rated low risk with no PHI carried.

How is Carestream fixing KRACK on DRX detectors?

Carestream advisory CARESTREAM-XRS-2017-01 of November 1, 2017 says Carestream is preparing detector patches and access point firmware updates for the DRX products affected by CVE-2017-13077 through CVE-2017-13088.

← Back to Vulnerabilities