Stored passwords recoverable in a Siemens imaging platform

MedDevice Cyber Staff · Feb 10 · 2 min read · Via Siemens Healthineers

Siemens Healthineers advisory SSA-016040 covers syngo.plaza VB30E before VB30E_HF07. CVE-2024-52334, weak encoding for a stored password, base score 5.3.

Reversible password storage tends to survive in long-lived clinical products because it solves an immediate engineering problem. A system that can decode its own stored secret can support legacy integrations, printed recovery steps and support staff who reset accounts by hand. Each of those conveniences quietly assumes the password store will never be read by anyone hostile, and on imaging software that assumption holds only until the moment it does not.

The record such a platform holds is not incidental. syngo.plaza sits in the imaging workflow, and an account recovered from its password store is an account inside the system that reads, routes and stores studies. Credentials pulled from a single weak store also travel, because operators reuse them across the consoles and shares that a hospital imaging estate is strung together from.

Weak encoding is not encryption. It is a reversible transform that looks like protection to an auditor and offers none to an attacker who can read the store. Recover the scheme and the passwords fall out. Store them hashed, salted, one-way, so that not even your own software can recover the plaintext. The fix is VB30E_HF07.

The advisory itself follows the shape coordinated disclosure has settled into for large device makers: a vendor security bulletin with its own identifier, a named vulnerability record, and a hotfix folded into the affected release. What the finding signals is narrower and more stubborn. Credential storage is among the most basic controls in software, and the weak form keeps producing advisories on medical platforms because it is cheap to build and, once shipped, close to permanent in the field.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

syngo.plaza VB30E stored passwords with weak encoding, so an attacker could recover the originals (Siemens SSA-016040). Update to VB30E_HF07 and force a password reset for every account, since stored secrets should be assumed recovered.

Update to VB30E_HF07. Apply the fixed build named in Siemens SSA-016040.
Reset all passwords. Weak encoding means stored secrets may already be recovered, so rotate every account after updating.
Hash with a modern algorithm. Store credentials with a salted, slow password hash so recovery from the store is not feasible even if it leaks.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Contributing

app_user_accounts app_roles net_remote_access data_phi use_hospital_net app_web_ui

EMB3D

PID-3321 PID-3322 PID-4113

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Questions & Answers

What is the weakness in Siemens syngo.plaza?

syngo.plaza VB30E stored passwords with weak encoding. An attacker who reached the stored values could recover the original passwords and gain unauthorized access. It is tracked as CVE-2024-52334 in Siemens advisory SSA-016040.

How would an attacker use it?

They first need access to where the passwords are stored. From there, weak encoding means recovering the real passwords is straightforward, which then opens the account those credentials belong to.

What is the response?

Move to the fixed version in SSA-016040 and rotate the affected passwords once patched, since the old values may already be recoverable.

← Back to Vulnerabilities