Vulnerability

GE Aestiva and Aespire anesthesia devices can have alarms silenced through unsecured terminal servers

MedDevice Cyber Staff · Jul 9 · 2 min read · Via CISA ICSMA-19-190-01

CISA published advisory ICSMA-19-190-01 on July 9, 2019, for CVE-2019-10966 in GE Healthcare anesthesia devices. The listed products are the Aespire 7100, 7900, 100 and Protiva Carestation View; the Aestiva 7100 and 7900 MRI; the Aisys CS2, Avance, Amingo and Avance CS2; and the Carestation 620, 650 and 650c. Elad Luz of CyberMDX reported it.

The weakness is improper authentication (CWE-287) with a CVSS v3 base score of 5.3. It exists when the devices' serial ports are connected through an added, unsecured terminal server to a TCP/IP network. An attacker who reaches that terminal server could remotely modify device configuration and silence alarms.

CISA's risk evaluation ties the exposure to the configuration of certain terminal server implementations that extend the anesthesia device serial ports to TCP/IP networks. The fix therefore sits largely with whoever installed and configured the terminal server.

GE Healthcare recommends secure terminal servers, which provide encryption, VPN, user authentication, network controls, logging, audit capability and secure configuration management. It also recommends governance and secure deployment measures such as network segmentation, VLANs and device isolation, and said it would post updates for affected users on its security page.

A flaw rated 5.3 that can silence alarms on an anesthesia delivery system deserves priority well above its score.

Are you a representative of GE HealthCare? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

No device software fix is named for CVE-2019-10966; the exposure comes from unsecured terminal servers that bridge GE anesthesia device serial ports to TCP/IP. Replace or reconfigure those terminal servers with secure ones that authenticate users and encrypt traffic, and isolate them on a segmented network. Check GE Healthcare's security page for updates.

Find every serial bridge. List each Aestiva, Aespire, Aisys CS2 and Carestation unit whose serial port runs through a terminal server.
Use secure terminal servers. Require user authentication, encryption and logging on every terminal server that stays in service.
Segment the anesthesia network. Put terminal servers and anesthesia devices on isolated VLANs reachable only by the systems that need them.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Serial interface

Contributing

Therapy delivery Wired network

Aestiva

PID-14 Serial interface Therapy delivery

Aespire

PID-14 Serial interface

Aisys CS2

Serial interface

Carestation

Serial interface

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
ID Now Instrument, ID Now Influenza A & B 2, ID NOW Strep A 2	Abbott	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
IonicRF Generator	Abbott	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Welch Allyn Connex Spot Monitor; 901058 Vital Signs Monitor Core	Baxter	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
BD Alaris System with Guardrails Suite MX v12.1.2	BD	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Ceribell Monitor	Ceribell	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
FORE-SIGHT ELITE Absolute Tissue Oximeter	Edwards Lifesciences	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Agilia VP Infusion System	Fresenius Kabi	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Sonosite PX Ultrasound System	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
CARESCAPE ONE and CARESCAPE DOCK F0	GE HealthCare	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Versana Premier	GE HealthCare	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Vivid iq	GE HealthCare	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer
Vivid S60N, Vivid S70N	GE HealthCare	Same property (MITRE EMB3D)PID-14	No feedback feed from manufacturer

26 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2019-10966 in GE Aestiva and Aespire anesthesia devices?

CVE-2019-10966 is an improper authentication issue (CVSS v3 5.3) in GE Healthcare Aestiva, Aespire, Aisys CS2 and Carestation anesthesia devices. When their serial ports are connected to a TCP/IP network through an unsecured terminal server, an attacker could remotely modify device configuration and silence alarms. CISA disclosed it in ICSMA-19-190-01 on July 9, 2019.

How does GE Healthcare recommend mitigating CVE-2019-10966?

GE Healthcare recommends using secure terminal servers, with encryption, VPN, user authentication, logging and audit capability, when connecting Aestiva, Aespire, Aisys CS2 or Carestation anesthesia device serial ports to TCP/IP networks, plus network segmentation, VLANs and device isolation, per CISA advisory ICSMA-19-190-01.

← Back to Vulnerabilities