Vulnerability

Ethicon Endo-Surgery Generator Gen11 accessory authentication can be bypassed

MedDevice Cyber Staff · Nov 28 · 2 min read · Via CISA ICSMA-17-332-01

CISA published advisory ICSMA-17-332-01 on November 28, 2017, for the Ethicon Endo-Surgery Generator Gen11. Johnson & Johnson, Ethicon's parent company, reported the flaw itself.

CVE-2017-14018 is improper authentication (CWE-287) with a CVSS v3 base score of 4.8. The authentication mechanism between the generator and its single-patient use products can be bypassed, so unauthorized devices can be connected to the generator. CISA rates the integrity impact high and availability impact low.

The vector string requires physical access and high attack complexity. An attacker has to be in the operating room with a counterfeit or modified instrument, which limits remote abuse and leaves supply chain substitution as the realistic scenario.

Ethicon contacted users and started a field cybersecurity update, made available on November 29, 2017, the day after the advisory. Questions go to the Ethicon sales representative or the Ethicon Customer Support Center.

Accessory authentication on an energy device is a safety function. If the generator cannot tell a genuine instrument from a substitute, the energy settings it applies rest on a guess.

Are you a representative of Ethicon Endo-Surgery? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the Ethicon field cybersecurity update for the Generator Gen11, available since November 29, 2017. Ethicon contacted users directly; confirm every generator in service received it. Buy single-patient use products only through authorized channels.

Confirm the field update. Check that each Generator Gen11 has received the November 29, 2017 cybersecurity update from Ethicon.
Control instrument sourcing. Source single-patient use products only through authorized distribution so substitutes do not reach the operating room.
Authenticate accessories cryptographically. Design generator to accessory authentication so it cannot be bypassed by a cloned or modified instrument.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Therapy delivery

Ethicon Endo-Surgery Generator Gen11

Therapy delivery

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2017-14018 in the Ethicon Endo-Surgery Generator Gen11?

CVE-2017-14018 is an improper authentication flaw (CWE-287, CVSS v3 4.8) in the Ethicon Endo-Surgery Generator Gen11. The authentication between the generator and single-patient use products can be bypassed, letting unauthorized devices connect. CISA published advisory ICSMA-17-332-01 on November 28, 2017.

When was the Ethicon Generator Gen11 security update released?

Ethicon Endo-Surgery made its field cybersecurity update for the Generator Gen11 available on November 29, 2017, addressing CVE-2017-14018 described in CISA advisory ICSMA-17-332-01.

← Back to Vulnerabilities