Fresenius says Fresenius Kabi pumps and Conox do not use the NicheStack TCP/IP stack hit by INFRA:HALT

MedDevice Cyber Staff · Oct 12 · 2 min read · Via Fresenius INFRA:HALT statement

Fresenius published an INFRA:HALT statement on October 12, 2021. The 14 vulnerabilities sit in the HCC Embedded InterNiche TCP/IP stack, previously known as InterNiche NicheStack, and include CVE-2020-25767, CVE-2021-31226 and CVE-2021-36762. ICSA-21-217-01 gives them an overall CVSS score of 9.8, rated critical.

Per ICSA-21-217-01, exploitation may result in unauthorized access to arbitrary information, DNS cache poisoning, remote code execution, or a denial-of-service condition. The weakness list includes use of insufficiently random values and generation of predictable numbers or identifiers.

Fresenius Kabi lists Agilia, Exelia and INfusia infusion pumps, Amika and Enfusia enteral nutrition pumps, Conox, the Vigilant Software Suite, three Partner accessories and INfusia Centro as not affected in all versions, since these products are not using the affected TCP/IP stack. Embedded stack exposure is a supply chain question, and the durable answer is a component inventory that names the stack.

Are you a representative of Fresenius Kabi? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Fresenius says the listed Fresenius Kabi products do not use the InterNiche TCP/IP stack, so INFRA:HALT needs no device fix on them. Confirm the stack status for other embedded devices on the same network. Keep the medical network firewalled and monitored.

Record the assessment. File the October 12, 2021 Fresenius statement against the listed Fresenius Kabi products.
Check other embedded devices. Ask other device makers whether their products embed InterNiche NicheStack.
Use deep packet inspection. Deploy application firewalls capable of deep packet inspection at the medical network boundary, as Fresenius recommends.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Off-the-shelf software

Contributing

Hospital network

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Are Fresenius Kabi infusion pumps affected by INFRA:HALT?

No. Fresenius's October 12, 2021 statement says Fresenius Kabi Agilia, Exelia and INfusia pumps, Amika and Enfusia pumps, Conox and the Vigilant Software Suite do not use the InterNiche TCP/IP stack affected by INFRA:HALT (ICSA-21-217-01).

What can an attacker do with the INFRA:HALT NicheStack vulnerabilities?

According to ICSA-21-217-01, the 14 INFRA:HALT vulnerabilities in the HCC Embedded InterNiche TCP/IP stack may allow unauthorized access to information, DNS cache poisoning, remote code execution or denial of service, with an overall CVSS score of 9.8.

← Back to Vulnerabilities