Vulnerability

Medtronic Paceart Optima messaging service allows remote code execution through deserialization

MedDevice Cyber Staff · Jun 29 · 3 min read · Via CISA ICSMA-23-180-01

CISA published advisory ICSMA-23-180-01 on June 29, 2023, covering CVE-2023-31222 in the Medtronic Paceart Optima system, versions 1.11 and prior. The flaw is deserialization of untrusted data (CWE-502), scored 9.8 under CVSS v3. Medtronic reported it.

Exposure depends on configuration. If a healthcare delivery organization has enabled the optional Paceart Messaging Service, an unauthorized user can send specially crafted messages to the system and get remote code execution, a denial of service, or both.

Code execution on Paceart Optima could mean deletion, theft or modification of the system's cardiac device data, or using the server as a base for further network penetration. A denial of service could slow the system or leave it unresponsive. CISA reported no known public exploits.

Medtronic's fix is version 1.12, scheduled through Medtronic. Until then, sites running a combined Application and Integration Server should call Paceart Optima technical support for immediate steps.

For other configurations the mitigation is to switch the feature off: stop the Paceart Messaging Service on the Application Server and set its startup type to Disabled, then remove the Message Queuing feature through Server Manager. The vulnerability stays mitigated as long as the service remains disabled.

An optional service that nobody uses should never be listening. Ship it disabled and make enabling it a deliberate act.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update Medtronic Paceart Optima to version 1.12, scheduled through Medtronic. Until then, disable the Paceart Messaging Service and remove Message Queuing on the Application Server, which keeps CVE-2023-31222 mitigated while the service stays off. Combined Application and Integration Server sites should call Paceart Optima technical support.

Schedule the 1.12 update. Contact Medtronic to book the Paceart Optima update that fixes CVE-2023-31222.
Disable the Paceart Messaging Service. Stop the service on the Application Server, set startup to Disabled and remove the Message Queuing feature.
Call support for combined servers. Sites running a combined Application and Integration Server need Medtronic technical support for immediate mitigation.
Never deserialize untrusted input. Software makers should accept only typed, validated message formats on any network listener.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Patient or study database Named operating system Hospital network

Paceart Optima System

PID-41 PID-23 Patient or study database Named operating system Hospital network

Fix the class in your product

The product turns untrusted bytes into objects without constraint. As the maker, stop deserializing untrusted data into arbitrary types: move to a schema-validated format across trust boundaries, and set any framework type filter to its most restrictive value.

Allow-list types. Validate structure and allow-list expected types before constructing anything.
Restrict the framework. On .NET Remoting set TypeFilterLevel to Low, or replace remoting with an authenticated schema-checked API.
Block the endpoint. Firewall the deserialization port so untrusted hosts cannot reach it.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2023-31222 in Medtronic Paceart Optima?

CVE-2023-31222 (CVSS 9.8) is a deserialization of untrusted data flaw in Medtronic Paceart Optima 1.11 and prior. When the optional Paceart Messaging Service is enabled, crafted messages can cause remote code execution or denial of service. CISA covered it in advisory ICSMA-23-180-01 on June 29, 2023.

How do you mitigate CVE-2023-31222 in Paceart Optima without upgrading?

Per CISA advisory ICSMA-23-180-01, disable the Paceart Messaging Service on the Application Server and remove the Message Queuing feature; the flaw stays mitigated while the service is disabled. Sites with a combined Application and Integration Server should contact Paceart Optima technical support.

Which Paceart Optima version fixes CVE-2023-31222?

Medtronic Paceart Optima version 1.12 fixes CVE-2023-31222. Medtronic asks users to contact it to schedule the update, per CISA advisory ICSMA-23-180-01.

← Back to Vulnerabilities

Sources

Medtronic: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: Medtronic