Fresenius says Fresenius Kabi pumps and the 4008S do not use the Treck stack behind Ripple20

MedDevice Cyber Staff · Jul 6 · 3 min read · Via Fresenius Ripple20 statement

Fresenius published a Ripple20 statement on July 6, 2020 and updated it on July 9, 2020. CISA advisory ICSA-20-168-01 covers 19 vulnerabilities in the Treck TCP/IP stack, CVE-2020-11896 to CVE-2020-11914, with an overall CVSS score of 10.0.

The statement quotes CERT/CC VU#257161: a remote, unauthenticated attacker may be able to use specially-crafted network packets to cause a denial of service, disclose information, or execute arbitrary code.

Fresenius Kabi lists Agilia, Exelia and INfusia infusion pumps, Amika and Enfusia enteral nutrition pumps, Conox, the Vigilant Software Suite, the Agilia, Exelia and Amika Partner accessories and INfusia Centro as not affected in all versions. Update A added Fresenius Medical Care's 4008S and UniDataLink. The stated reason covers all of them: the listed products are not using the Treck Inc. TCP/IP stack.

CERT/CC itself blamed the lack of supply chain visibility for making Ripple20 hard to assess. A vendor statement that names the stack it checked for belongs in the asset record.

Are you a representative of Fresenius Kabi or Fresenius Medical Care? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Fresenius says none of the listed Fresenius Kabi or Fresenius Medical Care products use the Treck TCP/IP stack, so Ripple20 (CVE-2020-11896 to CVE-2020-11914) needs no device fix on them. Other embedded devices on the network may still carry Treck code. Keep medical devices isolated and unreachable from the Internet.

Record the assessment. File the July 6, 2020 statement and its July 9, 2020 Update A with the listed products.
Hunt for Treck elsewhere. Ask the makers of other networked devices on the medical network whether they embed the Treck stack.
Block Internet reachability. Ensure medical devices are not accessible from the Internet and sit in dedicated medical networks.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Off-the-shelf software

Contributing

Wired network Hospital network

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Is the Fresenius Medical Care 4008S affected by Ripple20?

No. Update A of Fresenius's Ripple20 statement, dated July 9, 2020, lists the Fresenius Medical Care 4008S and UniDataLink as not affected because they do not use the Treck TCP/IP stack behind CVE-2020-11896 to CVE-2020-11914.

Do Fresenius Kabi infusion pumps use the Treck TCP/IP stack?

No. Fresenius's July 6, 2020 Ripple20 statement says Fresenius Kabi Agilia, Exelia and INfusia pumps, Amika and Enfusia pumps, Conox and the Vigilant Software Suite are not using the Treck Inc. TCP/IP stack and are not affected by ICSA-20-168-01.

← Back to Vulnerabilities