Vulnerability

Fujifilm FCR Capsula X and Carbon X cassette readers expose unauthenticated telnet

MedDevice Cyber Staff · Apr 23 · 3 min read · Via CISA ICSMA-19-113-01

CISA published advisory ICSMA-19-113-01 on April 23, 2019, covering two vulnerabilities in Fujifilm computed radiography cassette readers: the FCR Capsula X, FCR Carbon X and FCR XC-2, all CR-IR 357. Marc Ruef and Rocco Gagliardi of Scip AG reported them.

CVE-2019-10950 (CWE-284, CVSS v3 9.8) is the serious one. The device provides telnet services with no authentication, and an attacker who reaches them may get to the underlying operating system and run arbitrary code. CVE-2019-10948 (CWE-400, CVSS 7.5) is a denial of service: an overflow of TCP packets leaves the reader needing a manual reboot, with potential image loss.

Fujifilm did not ship a patch. Its answer is a configuration called Secure Host, which tells the CR-IR 357 to ignore all network traffic except from the IP address of the Fujifilm image acquisition console. The catch is that it prevents more than one console from sharing the reader unit, so sites that share readers have to call Fujifilm to discuss options.

Fujifilm also put network security first: keep the reader on a segment only authorized devices and staff can reach, and separate guest or public traffic with a VLAN.

An open telnet port on an imaging peripheral is an admin console for anyone on the subnet, and a source IP allowlist is the least you can put in front of it.

Are you a representative of Fujifilm Healthcare? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

No software fix is listed. Ask Fujifilm to enable Secure Host on each CR-IR 357 reader so it accepts traffic only from its image acquisition console; sites sharing a reader across consoles need to work out an alternative with Fujifilm. Put the readers on a restricted segment so telnet is unreachable from the wider network.

Request Secure Host. Contact Fujifilm at 888-385-4633 to enable it on readers that serve a single console.
Isolate the readers. Place CR-IR 357 units on a segment reachable only by authorized devices and staff.
Block telnet at the boundary. Filter telnet to the readers from every host except the acquisition console.
Plan for shared readers. Where several consoles share a reader, agree on a compensating design with Fujifilm.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wired network

Contributing

DICOM or image parsing Hospital network

FCR Capsula X / FCR Carbon X / FCR XC-2

PID-331 PID-41 PID-23

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2019-10950 in the Fujifilm FCR Capsula X and Carbon X?

CVE-2019-10950 (CWE-284, CVSS v3 9.8) is an unauthenticated telnet service in Fujifilm FCR Capsula X, FCR Carbon X and FCR XC-2 CR-IR 357 cassette readers that may let an attacker access the underlying operating system. CISA published it as ICSMA-19-113-01 on April 23, 2019.

How does Fujifilm Secure Host mitigate the CR-IR 357 vulnerabilities?

Secure Host configures the Fujifilm CR-IR 357 reader to ignore all network traffic except from the IP address of the Fujifilm image acquisition console, which blocks CVE-2019-10950 and CVE-2019-10948 from other hosts. It prevents sharing one reader across multiple consoles, per CISA advisory ICSMA-19-113-01 from April 23, 2019.

← Back to Vulnerabilities