Vulnerability

Hillrom Welch Allyn Connex and Spot devices carry chained out-of-bounds write and read flaws

MedDevice Cyber Staff · Jun 1 · 3 min read · Via CISA ICSMA-21-152-01

CISA published advisory ICSMA-21-152-01 on June 1, 2021, for Hillrom's Welch Allyn medical device management products. Itamar Cohen-Matalon of Medigate Research Labs reported the flaws.

CVE-2021-27410 is an out-of-bounds write (CWE-787) that may corrupt data or allow code execution. CVE-2021-27408 is an out-of-bounds read (CWE-125) that leaks information, which can lead to arbitrary code execution if chained to the write. Both score CVSS v3 5.9, with adjacent network access, high attack complexity and low privileges in the vector.

The affected list spans bedside and back-end products: Connex Vital Signs Monitor and Connex Integrated Wall System before 2.43.02, Connex Spot Monitor before 1.52, Spot Vital Signs 4400 before 1.11.00, Connex Central Station before 1.8.4 Service Pack 01, the Connex Device Integration Suite Network Connectivity Engine before 5.3, the Welch Allyn Software Development Kit before 3.2, the Service Monitor before 1.7.0.0 and the Service Tool before 1.10.

The SDK on that list explains the spread: the same code ships in monitors, central stations and service software. Fix the shared library once and every product that pulls it in still needs its own release and its own install.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update each Welch Allyn product to its fixed release: Service Tool 1.10, SDK 3.2, Connex Central Station 1.8.4 Service Pack 01, Network Connectivity Engine 5.3, Spot 4400 1.11.00, Service Monitor 1.7.0.0, Connex Spot Monitor 1.52, and Connex Vital Signs Monitor and Integrated Wall System 2.43.02. The flaws need adjacent network access, so keep monitors on segmented clinical networks until updated.

Map products to fixed versions. Inventory every Welch Allyn product in the advisory and its target release.
Update back end first. Patch the Connex Central Station and Network Connectivity Engine that many monitors talk to.
Segment the monitors. Keep vital signs monitors on an isolated clinical network segment until each is updated.
Fuzz the shared SDK. Test the common library's input handling, since one bug there ships in every product that embeds it.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Contributing

Hospital network Off-the-shelf software

Fix the class in your product

A crafted file drives the parser out of bounds. As the maker, validate every length and offset against the real buffer before you copy, decode in a sandboxed least-privilege process, and fuzz the path continuously so the next bug is yours to find.

Bound every copy. Check declared sizes against allocated buffers before memcpy; prefer memory-safe parsers for new work.
Sandbox the decoder. Run it least-privilege and isolated so a crash or exploit is contained, not privileged.
Fuzz as a release gate. Run malformed-input fuzzing on every file-format parser before shipping.

Mapped EMB3D mitigations

Questions & Answers

What are CVE-2021-27410 and CVE-2021-27408 in Hillrom Welch Allyn devices?

CVE-2021-27410 is an out-of-bounds write and CVE-2021-27408 an out-of-bounds read, both CVSS v3 5.9, in Hillrom Welch Allyn Connex monitors, Spot 4400, Connex Central Station, the Network Connectivity Engine, the Software Development Kit and service tools. Chained, they can allow arbitrary code execution, per CISA advisory ICSMA-21-152-01 from June 1, 2021.

Which Welch Allyn Connex Spot Monitor version fixes CVE-2021-27410?

CISA advisory ICSMA-21-152-01 lists Welch Allyn Connex Spot Monitor versions before 1.52 as affected by CVE-2021-27410 and CVE-2021-27408. Connex Vital Signs Monitor and Connex Integrated Wall System are affected before 2.43.02, and Spot Vital Signs 4400 before 1.11.00.

← Back to Vulnerabilities