Vulnerability

Karl Storz lists AIDA Bella and end-of-life AIDA HD Connect as affected by PrintNightmare

MedDevice Cyber Staff · Aug 26 · 2 min read · Via KARL STORZ security notice CVE-2021-34527

KARL STORZ published an updated security notice on August 26, 2021 for CVE-2021-34527, the Windows Print Spooler remote execution vulnerability. After evaluating its products, it lists two as affected when networked: WD350-KT, WD350 and WD300 AIDA Bella on Windows 10 IoT Enterprise LTSB 1607, and AIDA HD Connect models 20205501-140, 20205502-1, 20205701-140 and 20205702-1, software versions 17 to 20.

AIDA Bella will receive the Microsoft patch in its next release. For AIDA HD Connect, which is end of life, the guidance is to disable the print spooler or inbound remote printing.

End-of-life gear on the network turns every Windows flaw into a standing configuration task. Track which units got the change.

Are you a representative of Karl Storz? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Networked AIDA Bella and AIDA HD Connect units are exposed to CVE-2021-34527. AIDA Bella gets the Microsoft patch in its next release. AIDA HD Connect is end of life and needs the print spooler or inbound remote printing disabled.

Install the next AIDA Bella release. Apply the AIDA Bella release that carries the Microsoft Print Spooler patch.
Disable spooling on HD Connect. Turn off the print spooler or inbound remote printing on every AIDA HD Connect unit.
Plan HD Connect retirement. Schedule replacement of end-of-life AIDA HD Connect units, since future Windows flaws will land the same way.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Wired network Hospital network

AIDA Bella

PID-23 Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Is Karl Storz AIDA Bella affected by PrintNightmare CVE-2021-34527?

Yes, when networked. KARL STORZ's August 26, 2021 notice lists WD350-KT, WD350 and WD300 AIDA Bella on Windows 10 IoT Enterprise LTSB 1607 as affected, with the Microsoft patch coming in the next release.

What should AIDA HD Connect owners do about CVE-2021-34527?

AIDA HD Connect is end of life. KARL STORZ's August 26, 2021 notice tells customers to disable the print spooler or inbound remote printing on models 20205501-140, 20205502-1, 20205701-140 and 20205702-1, software versions 17 to 20.

← Back to Vulnerabilities