Vulnerability

Hamilton Medical T1 ventilator through 2.2.3 has hard-coded admin credentials

MedDevice Cyber Staff · Feb 16 · 3 min read · Via CISA ICSMA-21-047-01

CISA published advisory ICSMA-21-047-01 on February 16, 2021, covering the Hamilton Medical AG T1 Ventilator, Version 2.2.3 and prior. Researchers from ERNW Research GmbH and ERNW Enno Rey Netzwerke GmbH found three vulnerabilities, with Germany's BSI also credited.

CVE-2020-27278 (CWE-798, CVSS v3 3.5) is hard-coded credentials that give an attacker with physical access admin privileges on the configuration interface. CVE-2020-27282 (CWE-112, 4.3) is missing XML validation: a privileged attacker with physical access can upload crafted configuration files that render the ventilator persistently unusable. CVE-2020-27290 (CWE-200, 2.1) leaks valid checksums for tampered configuration files through the configuration interface's logs.

The low scores come from the physical access requirement, and all three are physical. Read as a chain, they describe the full path to a bricked ventilator: log in with the built-in admin account, get the log to bless a tampered file, then load it.

Hamilton Medical recommends users update to a version later than 2.2.3 where possible. A shared admin credential on a life-support device fails the moment one copy leaks.

Are you a representative of Hamilton Medical AG? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update Hamilton Medical T1 Ventilators to a version later than 2.2.3 where possible, as Hamilton recommends. Until then, control physical access to the ventilators and their configuration interface, and load configuration files only from trusted, controlled sources.

Update past 2.2.3. Move every T1 Ventilator to a version later than 2.2.3 where possible.
Control physical access. All three CVEs require physical access, so keep ventilators and their configuration ports in supervised areas.
Vet configuration files. Load configuration files only from a controlled source, since crafted files can render the device unusable.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Therapy delivery File import

T1 Ventilator

PID-332 PID-34 Role-based access File import Therapy delivery

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2020-27278 in the Hamilton Medical T1 ventilator?

CVE-2020-27278 is a set of hard-coded credentials in the Hamilton Medical T1 Ventilator Version 2.2.3 and prior that let an attacker with physical access obtain admin privileges on the configuration interface. CISA advisory ICSMA-21-047-01, published February 16, 2021, scores it 3.5 under CVSS v3.

Can a crafted file disable the Hamilton-T1 ventilator?

Yes. Per CISA advisory ICSMA-21-047-01, CVE-2020-27282 lets a privileged attacker with physical access render the Hamilton Medical T1 Ventilator (2.2.3 and prior) persistently unusable by uploading specially crafted configuration files. Hamilton recommends updating to a version later than 2.2.3.

← Back to Vulnerabilities