Vulnerability

Hillrom Welch Allyn ELI resting electrocardiographs contain hard-coded passwords

MedDevice Cyber Staff · Jun 16 · 2 min read · Via CISA ICSMA-22-167-01

CISA published advisory ICSMA-22-167-01 on June 16, 2022, for Hillrom's Welch Allyn ELI resting electrocardiographs: ELI 150c, BUR 150c and MLBUR 150c up to 2.2.0; ELI 250c and BUR 250c up to 2.1.2; ELI 280, BUR280 and MLBUR 280 up to 2.3.1; and ELI 380 up to 2.6.0. An anonymous party reported two vulnerabilities.

CVE-2022-26388 (CWE-259, CVSS v3 6.4) is a set of hard-coded, unchangeable passwords used for inbound authentication or outbound communication with external components. The vector needs physical access but no privileges. CVE-2022-26389 (CWE-284, CVSS v3 7.7) is improper access control to a resource, with a changed scope and a high availability impact.

Hillrom released software updates for every affected model and recommends upgrading to the latest versions, with instructions on its responsible disclosure page. It also listed workarounds to reduce risk before the update is applied.

ECG carts are walked from bed to bed and often sit unattended in hallways. A password nobody can change only stays secret until the first person pulls it from the firmware.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade every Welch Allyn ELI 150c, 250c, 280 and 380 electrocardiograph past the affected versions to Hillrom's latest release, using the instructions on Hillrom's disclosure page. Apply Hillrom's workarounds until the update is installed. Keep ECG carts under physical control, since CVE-2022-26388 needs hands on the device.

Update every ELI unit. Install Hillrom's latest software on ELI 150c, 250c, 280 and 380 models above the affected versions.
Apply the workarounds. Use Hillrom's recommended workarounds on any unit waiting for the update.
Secure the carts. Store electrocardiographs in controlled areas when not in use.
Remove fixed passwords in design. Credentials for inbound or outbound connections should be unique per device and changeable.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Physiological waveform processing Hospital network

Welch Allyn ELI Resting Electrocardiograph

PID-3321 User accounts Physiological waveform processing

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
LOGIQ e	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
CT Collaboration Live	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Image Management V15	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ARIA Radiation Therapy Management	Varian	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

Questions & Answers

What is CVE-2022-26388 in Welch Allyn ELI electrocardiographs?

CVE-2022-26388 is a hard-coded password flaw (CWE-259, CVSS v3 6.4) in Hillrom Welch Allyn ELI 150c, 250c, 280 and 380 resting electrocardiographs, disclosed in CISA advisory ICSMA-22-167-01 on June 16, 2022. The unchangeable passwords are used for inbound authentication or outbound communication.

Is there an update for the Hillrom ELI electrocardiograph vulnerabilities?

Yes. Per CISA advisory ICSMA-22-167-01, Hillrom has released software updates for all affected Welch Allyn ELI 150c, 250c, 280 and 380 models to address CVE-2022-26388 and CVE-2022-26389, and recommends upgrading to the latest versions.

← Back to Vulnerabilities