Vulnerability

Fresenius Kabi PharmaHelp allows privilege escalation through captured login data

MedDevice Cyber Staff · Nov 24 · 2 min read · Via Fresenius statement on CVE-2022-45611

Fresenius published a statement on November 23, 2023 covering CVE-2022-45611 in Fresenius Kabi PharmaHelp. All versions are affected; the CVE cites version 5.1.759.0. The score is CVSS 9.8.

The flaw allows escalated privileges via capture of user login information. With those privileges an attacker could read, change and delete configuration, operator and master data, the records a pharmacy compounding workflow runs on.

Fresenius lists network segmentation and restricted access as the mitigations, with no fixed version named. A 9.8 with no patch means the network boundary is the control, so wall PharmaHelp off from everything that does not need to reach it.

Are you a representative of Fresenius Kabi? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

No fixed PharmaHelp version is named for CVE-2022-45611 (CVSS 9.8). Segment PharmaHelp and restrict access to it as Fresenius recommends, and review operator accounts for misuse.

Segment PharmaHelp. Put PharmaHelp servers and clients on a restricted segment reachable only by pharmacy workstations.
Restrict access. Limit who can log in and from where, and remove unused operator accounts.
Audit master data. Review configuration, operator and master data for unexpected changes.
Rotate credentials. Reset operator passwords after segmentation, since login information may have been captured.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Patient or study database

PharmaHelp

PID-3321 User accounts Patient or study database

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2022-45611 in Fresenius Kabi PharmaHelp?

CVE-2022-45611 (CVSS 9.8) affects all versions of Fresenius Kabi PharmaHelp and allows escalated privileges via capture of user login information, with potential reading, changing and deletion of configuration, operator and master data. Fresenius covered it in a statement dated November 23, 2023.

Is there a patch for PharmaHelp CVE-2022-45611?

The Fresenius statement of November 23, 2023 names no fixed PharmaHelp version. It lists network segmentation and restricted access as mitigations for CVE-2022-45611.

Which PharmaHelp versions are affected by CVE-2022-45611?

Fresenius says all PharmaHelp versions are affected; the CVE record cites version 5.1.759.0.

← Back to Vulnerabilities