CISA published advisory ICSMA-19-311-02 on November 7, 2019, for Medtronic's Valleylab FT10 Energy Platform (VLFT10GEN) software 4.0.0 and prior, Valleylab FX8 Energy Platform (VLFX8GEN) software 1.0.0 and prior, and Valleylab Exchange Client 3.4 and prior. Medtronic reported the issues.
Three weaknesses chain together. CVE-2019-13543 (CWE-798, CVSS v3 5.8): the products use multiple sets of hard-coded credentials that can be used to read files. CVE-2019-13539 (CWE-328, CVSS 7.0): OS passwords are hashed with descrypt, and an attacker with local shell access can read those hashes. CVE-2019-3464 and CVE-2019-3463 (CVSS 9.8) come from a vulnerable version of the rssh utility used for file uploads, which can give administrative file access or arbitrary code execution.
CISA says successful exploitation could overwrite files or yield a remote, non-root shell. The rssh flaw is the entry point, and descrypt is a hashing scheme that falls quickly once an attacker can read the hashes.
Network connections on these generators are disabled by default, and the Ethernet port is disabled upon reboot. CISA adds that network connectivity is often enabled anyway, which is the configuration that matters.
Software patches are available for the FT10 now; FX8 patches are due in early 2020. Until patched, Medtronic recommends disconnecting the products from IP networks or segregating those networks so the devices are unreachable from untrusted networks such as the internet.
A default-off network port is a good design choice until the field turns it on. Assume it is on and patch accordingly.