Vulnerability

i-SENS SmartLog diabetes management software loads planted DLLs from its search path

MedDevice Cyber Staff · Sep 7 · 2 min read · Via CISA ICSMA-17-250-01

CISA published advisory ICSMA-17-250-01 on September 7, 2017, for an uncontrolled search path element vulnerability in i-SENS, Inc. SmartLog Diabetes Management Software. CVE-2017-13993 (CWE-428) carries a CVSS v3 base score of 7.3 and affects versions before 2.4.0. Independent researcher Mark Cross found it and tested the fix.

The attack is a classic DLL plant. An attacker places a crafted DLL in the application's search path, and if SmartLog loads it before the legitimate library, the attacker's code runs with the user's rights. The vector (AV:L/PR:L/UI:R) means local access and a user who launches the program.

CISA and i-SENS are clear about scope: the flaw does not affect the connected blood glucose monitor and would not impact delivery of therapy. The risk lives on the workstation that runs SmartLog, where glucose history is reviewed and where a foothold is worth having.

i-SENS released SmartLog version 2.4.1 on its website on September 1, 2017, six days before the advisory. Any companion application that loads libraries by bare name inherits this class of bug, so pin library paths at build time.

Are you a representative of i-SENS, Inc.? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade i-SENS SmartLog Diabetes Management Software to version 2.4.1, released September 1, 2017, which mitigates CVE-2017-13993. Until then, limit who can write to the directories SmartLog searches for libraries. The connected glucose monitor is not affected.

Install SmartLog 2.4.1. Replace any version before 2.4.0 with the 2.4.1 installer i-SENS published on September 1, 2017.
Restrict write access to application folders. Standard users should not be able to drop files into directories the program loads DLLs from.
Guard against delivered payloads. CISA advises users not to open unsolicited attachments or links, a common route for planting the DLL.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system

Contributing

Handles patient data

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity Gateway Suite	Dräger	Same signals	No feedback feed from manufacturer
AutoSeg	Fujifilm Healthcare	Same signals	No feedback feed from manufacturer
Portrait Central Viewer Application (Portrait CV A01)	GE HealthCare	Same signals	No feedback feed from manufacturer
Venue Fit	GE HealthCare	Same signals	No feedback feed from manufacturer
Brevera Biopsy System with CorLumina Imaging Technology	Hologic	Same signals	No feedback feed from manufacturer

Questions & Answers

What is CVE-2017-13993 in i-SENS SmartLog Diabetes Management Software?

CVE-2017-13993 is an uncontrolled search path element vulnerability (CVSS v3 7.3) in i-SENS SmartLog Diabetes Management Software before 2.4.0. A crafted DLL placed in the search path can run arbitrary code if loaded before the valid DLL, per CISA advisory ICSMA-17-250-01 of September 7, 2017.

Which SmartLog version fixes CVE-2017-13993?

i-SENS released SmartLog Diabetes Management Software version 2.4.1 on September 1, 2017, which mitigates CVE-2017-13993. Researcher Mark Cross tested the update and confirmed it resolves the issue, according to CISA advisory ICSMA-17-250-01.

Does the i-SENS SmartLog vulnerability affect the blood glucose monitor?

No. CISA advisory ICSMA-17-250-01 states that CVE-2017-13993 in i-SENS SmartLog does not affect the connected blood glucose monitor and would not impact delivery of therapy to the patient.

← Back to Vulnerabilities