Vulnerability

MIM Concurrent License Server lets unauthenticated network attackers run code through RMI

MedDevice Cyber Staff · Jun 9 · 3 min read · Via MIM Software advisory CVE-2023-30262

MIM Software disclosed CVE-2023-30262 in the MIM Concurrent License Server and MIM Local Concurrent License Server, versions 6.5.0 to 7.0.9. An unauthenticated attacker on the same network can send crafted RMI requests and execute arbitrary code, because the service deserializes untrusted data (CWE-502). Researcher Eric Guillen found it with The University of Kansas Health System.

Version 7.0.10 patches the flaw and 7.1.0 and later never had it. MIM also built a manual hotfix for unsupported 6.5.x to 6.9.x servers. No other MIM services or client installations are affected, the company says.

MIM calls the issue critical and declines to recommend any mitigation short of upgrading or the hotfix. For sites that need time, it suggests limiting which machines can reach the license service on port 13913 and reducing the service account's permissions. A license server that every planning workstation talks to is a good pivot point, so firewall it today and upgrade this week.

Are you a representative of MIM Software? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade MIM Concurrent License Server and MIM Local Concurrent License Server to 7.0.10 or 7.1.0 and later to fix CVE-2023-30262. Unsupported 6.5.x to 6.9.x servers can take MIM's manual hotfix. Until then, restrict access to port 13913 to licensed clients and reduce the service account's privileges.

Upgrade the license server. Move to 7.0.10 or any 7.1.0+ release, or apply MIM's hotfix on 6.5.x to 6.9.x.
Firewall port 13913. Allow only the client machines that need licenses to reach the MIM Concurrent License Service.
Shrink the service account. Run the license server under an account with only the rights it needs, so code execution does not mean domain reach.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wired network

Contributing

Hospital network

MIM Concurrent License Server

PID-41 PID-331 Wired network

Fix the class in your product

The product turns untrusted bytes into objects without constraint. As the maker, stop deserializing untrusted data into arbitrary types: move to a schema-validated format across trust boundaries, and set any framework type filter to its most restrictive value.

Allow-list types. Validate structure and allow-list expected types before constructing anything.
Restrict the framework. On .NET Remoting set TypeFilterLevel to Low, or replace remoting with an authenticated schema-checked API.
Block the endpoint. Firewall the deserialization port so untrusted hosts cannot reach it.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2023-30262 in the MIM Concurrent License Server?

CVE-2023-30262 is a deserialization of untrusted data flaw in MIM Concurrent License Server and MIM Local Concurrent License Server 6.5.0 to 7.0.9. Unauthenticated attackers on the same network can execute code with crafted RMI requests.

Which MIM License Server version fixes CVE-2023-30262?

MIM Software patched CVE-2023-30262 in 7.0.10, and 7.1.0 and later are not affected. A manual hotfix exists for unsupported 6.5.x to 6.9.x servers.

Who discovered the MIM License Server RMI vulnerability?

MIM Software credits security researcher Eric Guillen, working with The University of Kansas Health System, for reporting CVE-2023-30262.

← Back to Vulnerabilities