Vulnerability

Qualcomm Life Capsule products inherit Allegro RomPager cookie flaw scored 9.8

MedDevice Cyber Staff · Aug 28 · 2 min read · Via CISA ICSMA-18-240-01

CISA published advisory ICSMA-18-240-01 on August 28, 2018, for Qualcomm Life Capsule products. The flaw sits in a third-party component: the Allegro RomPager embedded web server, versions 4.01 through 4.34. Elad Luz of CyberMDX reported it to NCCIC.

CVE-2014-9222 (CWE-668, CVSS v3 9.8) lets an attacker send a specially crafted HTTP cookie to the web management portal and write arbitrary data to device memory. That can lead to remote code execution. The vector needs no privileges and no user interaction.

The CVE number dates to 2014. A known web server bug was still sitting in a medical device's management portal four years later, which is what happens when embedded components are not tracked by version.

The advisory record points Capsule customers to the vendor's customer portal for remediation.

Are you a representative of Qualcomm Life? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Get the remediation for affected Capsule products from the vendor's customer portal and confirm which RomPager version each unit runs. Versions 4.01 to 4.34 are affected. Until fixed, block network access to the web management portal from anything but management hosts.

Check the RomPager version. Identify Capsule units running Allegro RomPager 4.01 to 4.34.
Pull the vendor fix. Obtain remediation for affected units through the Capsule customer portal.
Lock down the web portal. Restrict the web management portal to management hosts only.
Track embedded components. Keep embedded web servers in the SBOM so a published CVE maps to shipped devices quickly.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface Off-the-shelf software

Contributing

Hospital network

Capsule

PID-311 Web interface Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2014-9222 in Qualcomm Life Capsule products?

CVE-2014-9222 is a flaw (CWE-668, CVSS v3 9.8) in the Allegro RomPager embedded web server, versions 4.01 to 4.34, used in Qualcomm Life Capsule products. A crafted HTTP cookie sent to the web management portal can write arbitrary data to device memory, per CISA advisory ICSMA-18-240-01 from August 28, 2018.

Who reported the RomPager vulnerability in Capsule medical devices?

Elad Luz of CyberMDX reported CVE-2014-9222 in the Allegro RomPager web server used by Qualcomm Life Capsule products to NCCIC. CISA published advisory ICSMA-18-240-01 on August 28, 2018.

← Back to Vulnerabilities