Vulnerability

Hillrom Welch Allyn cardiology software let SSO users log in as any AD account without a password

MedDevice Cyber Staff · Dec 9 · 2 min read · Via CISA ICSMA-21-343-01

CISA published advisory ICSMA-21-343-01 on December 9, 2021, covering CVE-2021-43935 in seven Hillrom Welch Allyn cardiology products: Q-Stress 6.0.0 to 6.3.1, X-Scribe 5.01 to 6.3.1, H-Scribe 5.01 to 6.4.0, R-Scribe 5.01 to 7.0.0, Connex Cardio 1.0.0 to 1.1.1, Diagnostic Cardiology Suite 2.1.0 and Vision Express 6.1.0 to 6.4.0. Hillrom disclosed it.

The flaw is an authentication bypass through an alternate path (CWE-288, CVSS v3 8.1). When the products are configured for single sign-on, they accept manual entry of any Active Directory account provisioned in the application without asking for a password. The attacker gets that account's full privileges, including privileged accounts.

Hillrom planned software updates in its next release, with workarounds in the interim, and pointed users to its responsible disclosure page for upgrade instructions.

SSO moves the password check to the identity provider, and an application that still offers a manual username field has to send that path through the same check.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade the affected Welch Allyn cardiology products when Hillrom's updated releases are available, following its responsible disclosure page. Until then, review whether SSO is enabled and apply Hillrom's interim workarounds, and audit which Active Directory accounts are provisioned in each application.

Check SSO configuration. The bypass only applies when the products are configured to use SSO.
Trim provisioned accounts. Remove Active Directory accounts from the applications that do not need access, especially privileged ones.
Install Hillrom updates. Upgrade to the fixed releases listed on Hillrom's responsible disclosure page.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Role-based access Physiological waveform processing Hospital network

Welch Allyn cardiology products

PID-3321 User accounts Role-based access

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2021-43935 in Hillrom Welch Allyn cardiology products?

CVE-2021-43935 (CWE-288, CVSS v3 8.1) lets Hillrom Welch Allyn cardiology products configured for SSO accept manual entry of any provisioned Active Directory account without a password. CISA published it as ICSMA-21-343-01 on December 9, 2021.

Which Welch Allyn products are affected by CVE-2021-43935?

CISA advisory ICSMA-21-343-01 lists Q-Stress 6.0.0 to 6.3.1, X-Scribe 5.01 to 6.3.1, H-Scribe 5.01 to 6.4.0, R-Scribe 5.01 to 7.0.0, Connex Cardio 1.0.0 to 1.1.1, Diagnostic Cardiology Suite 2.1.0 and Vision Express 6.1.0 to 6.4.0.

← Back to Vulnerabilities