Vulnerability

Dräger Infinity Delta monitors allow kiosk escape, reboot loops and unauthenticated log access

MedDevice Cyber Staff · Jan 22 · 3 min read · Via CISA ICSMA-19-022-01

CISA published advisory ICSMA-19-022-01 on January 22, 2019, covering three vulnerabilities in Dräger patient monitors: the Infinity Delta, Delta XL, Kappa and Infinity Explorer C700, all versions. Marc Ruef and Rocco Gagliardi of scip AG reported them. Dräger released fixes in December 2018 and documented them in its product security advisory 201802.

The most severe is CVE-2018-19012 (CWE-269, CVSS v3 8.4). A specific dialog lets a user break out of kiosk mode and reach the underlying operating system, and from there take control of it. The vector is local with no privileges required, so anyone standing at the monitor is the threat model.

CVE-2018-19010 (CWE-20, CVSS 6.5) is a malformed network packet that makes the monitor reboot. Sent repeatedly, it can keep the monitor rebooting until it falls back to default configuration and loses network connectivity, which disrupts patient monitoring.

CVE-2018-19014 (CWE-532, CVSS 4.3) exposes log files over an unauthenticated network connection. The logs reveal internals of the monitor, its location and its wired network configuration.

The three findings chain in an obvious order. Unauthenticated logs give an attacker the network map, the malformed packet knocks a monitor off central monitoring, and the kiosk breakout turns brief physical access into control of the operating system.

Kiosk mode only hides the operating system, and one overlooked dialog is enough to reach it.

Are you a representative of Dräger? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Install the Delta/Infinity Explorer VF10.1 software releases that Dräger shipped in December 2018 through Dräger ServiceConnect. They fix the kiosk breakout, the reboot packet and the unauthenticated log access. Until every monitor is updated, limit who can reach the monitor network and who can touch the monitor interface unattended.

Deploy VF10.1. Pull the Delta/Infinity Explorer VF10.1 releases from Dräger ServiceConnect and update Infinity Delta, Delta XL, Kappa and Explorer C700 units.
Restrict the monitor network. Block general hosts from reaching the monitors so the malformed packet and the log service are out of reach.
Alert on repeated reboots. A monitor that cycles and returns with default configuration is a sign of CVE-2018-19010 and needs a check before it goes back into use.
Read Dräger advisory 201802. The vendor advisory maps each fix to the affected components.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Wired network Hospital network

Infinity Delta patient monitors

PID-23 PID-28 PID-331 Wired network

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2018-19012 in Dräger Infinity Delta patient monitors?

CVE-2018-19012 is an improper privilege management flaw (CVSS v3 8.4) in Dräger Infinity Delta, Delta XL, Kappa and Infinity Explorer C700 monitors. A specific dialog allows breaking out of kiosk mode to reach and control the underlying operating system. CISA disclosed it in ICSMA-19-022-01 on January 22, 2019.

How do I fix the Dräger Infinity Delta vulnerabilities in ICSMA-19-022-01?

Dräger released fixes in December 2018 as Delta/Infinity Explorer VF10.1 software releases, available through Dräger ServiceConnect. They address CVE-2018-19010, CVE-2018-19012 and CVE-2018-19014 and are described in Dräger product security advisory 201802.

← Back to Vulnerabilities