Vulnerability

Innokas VC150 vital signs monitor accepts HL7 injection and stored XSS

MedDevice Cyber Staff · Jan 7 · 2 min read · Via CISA ICSMA-21-007-01

CISA published advisory ICSMA-21-007-01 on January 7, 2021, covering two vulnerabilities in the Innokas Yhtymä Oy VC150 vital signs monitor, versions before 1.7.15. Julian Suleder, Nils Emmerich and Birk Kauer of ERNW Research and Dr. Oliver Matula of ERNW Enno Rey Netzwerke reported them.

CVE-2020-27262 (CWE-79, CVSS v3 4.6) is stored cross-site scripting through the filename parameter of several update endpoints in the administrative web interface. CVE-2020-27260 (CWE-74, CVSS 5.3) is more unusual: someone physically near the monitor with a connected barcode reader can inject HL7 v2.x segments into specific HL7 messages. The scope change in its vector reflects that the injected data lands in downstream systems.

The risk evaluation names modified communications to downstream devices and disabled features. Innokas recommends version 1.7.15b or later, which mitigates both.

A barcode scanner is a keyboard, and anything it types into an HL7 message needs the same escaping as any other untrusted field.

Are you a representative of Innokas Yhtymä Oy? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the VC150 to software version 1.7.15b or later, which fixes both flaws. Until then, limit access to the administrative web interface and control who can attach a barcode reader to the monitor.

Install 1.7.15b. Update every VC150 running a version before 1.7.15.
Restrict the admin interface. Allow the administrative web interface only from management hosts.
Validate inbound HL7. Have the receiving interface engine reject malformed or unexpected segments from the monitors.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

HL7 or FHIR integration Web interface

Contributing

Hospital network USB port

VC150

PID-311 Web interface HL7 or FHIR integration

Fix the class in your product

Field input is reflected into a WebView without encoding, so input becomes script in the app context. As the maker, context-encode every value before it renders, set a strict content security policy, and prefer native rendering for sensitive data.

Encode at every sink. Render user data with textContent or an auto-escaping template, never innerHTML.
Set a strict CSP. Block inline and injected script as a second layer.
Prefer native rendering. Keep PHI out of a WebView where a missed encode becomes code.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novum IQ Large Volume Pump	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Aperio GT 450 DX	Leica Biosystems	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aetherSlide	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer

12 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2020-27260 in the Innokas VC150 vital signs monitor?

CVE-2020-27260 (CWE-74, CVSS v3 5.3) is an HL7 v2.x injection flaw in the Innokas Yhtymä Oy VC150 vital signs monitor before 1.7.15. A physically proximate attacker with a connected barcode reader can inject HL7 v2.x segments into HL7 messages. CISA published it in ICSMA-21-007-01 on January 7, 2021.

Which Innokas VC150 version fixes the XSS and HL7 injection flaws?

Innokas Yhtymä Oy recommends VC150 software version 1.7.15b or later, which mitigates CVE-2020-27262 and CVE-2020-27260, according to CISA advisory ICSMA-21-007-01 from January 7, 2021.

← Back to Vulnerabilities