Vulnerability

Siemens Healthineers reports two vulnerabilities in RAPIDLab 1200 and RAPIDPoint blood gas analyzers

MedDevice Cyber Staff · Jun 12 · 3 min read · Via Siemens Healthineers security disclosure

Siemens Healthineers published advisory SSA-755010 on June 12, 2018, covering two vulnerabilities, CVE-2018-4845 and CVE-2018-4846, in the RAPIDLab 1200 Series and RAPIDPoint 400, 405 and 500 blood gas analyzers. The company recommended specific countermeasures to mitigate the risk.

Exposure depends on how the analyzer is deployed. The advisory lists all versions of RAPIDLab 1200, RAPIDPoint 400 and RAPIDPoint 500 used without Siemens Healthineers Informatics products, and separate version ranges for systems used with them: RAPIDLab 1200 Series below V3.3, RAPIDPoint 500 at V2.3 and earlier, V2.4.X and V3.0 and later, and all RAPIDPoint 400 versions.

Siemens Healthineers said no public exploitation was known at publication. Point-of-care analyzers sit close to the patient and report results clinicians act on fast, which makes a quiet compromise there costly to miss.

Are you a representative of Siemens Healthineers? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the countermeasures Siemens Healthineers lists in SSA-755010 for each RAPIDLab and RAPIDPoint configuration, which differ by version and by whether Informatics products are in use. Keep the analyzers on a restricted network segment until those are confirmed.

Classify each analyzer. Record model, software version and whether it connects through Siemens Healthineers Informatics products.
Apply the listed countermeasures. Follow the SSA-755010 measures for each configuration, working with Siemens Healthineers service.
Segment point-of-care devices. Limit network reach to the analyzers to the data manager and service hosts they need.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Contributing

Hospital network

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What are CVE-2018-4845 and CVE-2018-4846 in Siemens RAPIDPoint analyzers?

CVE-2018-4845 and CVE-2018-4846 are two vulnerabilities in the Siemens Healthineers RAPIDLab 1200 Series and RAPIDPoint 400, 405 and 500 blood gas analyzers, disclosed in advisory SSA-755010 on June 12, 2018.

Which RAPIDLab 1200 versions are affected by SSA-755010?

Advisory SSA-755010 of June 12, 2018 lists all RAPIDLab 1200 versions used without Siemens Healthineers Informatics products, and RAPIDLab 1200 Series versions below V3.3 used with them.

← Back to Vulnerabilities