Vulnerability

Silex modules in GE MobileLink allow unauthenticated setting changes and command injection

MedDevice Cyber Staff · May 8 · 3 min read · Via CISA ICSMA-18-128-01

CISA published advisory ICSMA-18-128-01 on May 8, 2018, later revised as Update B, covering two vulnerabilities in Silex Technology modules integrated into GE Healthcare MobileLink. Affected are the GEH-500 version 1.54 and earlier, the GEH-SD-320AN version GEH-1.1 and earlier, the SD-320AN version 2.01 and earlier, and all versions of the SX-500. Eric Evenchick of Atredis Partners reported them.

CVE-2018-6020 (CWE-287, CVSS v3 6.5) is missing authentication. Certain POST requests are processed without verifying the caller, which lets an unauthenticated attacker on the network modify system settings. CVE-2018-6021 (CWE-78, CVSS v3 7.4) is OS command injection: a system call parameter is not properly sanitized, and an attacker with low privileges can turn it into remote code execution.

The two chain cleanly. Settings can be changed with no login, and command injection hands over the module's operating system once any account is in reach. CISA's risk evaluation says successful exploitation could allow modification of system settings and remote code execution.

The fixes split by model. For CVE-2018-6020 on the SX-500, the vendors recommend enabling the update account in the web interface, which is not enabled by default, and setting its secondary password to block unauthenticated configuration changes. For CVE-2018-6021 on the GEH-SD-320AN, Silex and GE released firmware version 1.14. The SX-500 reached end of life in 2011 and the SD-320AN in November 2017.

A protective account that ships disabled protects almost nobody, because defaults are the configuration most fielded units run for their whole service life.

Are you a representative of Silex Technology or GE HealthCare? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the GEH-SD-320AN to firmware version 1.14 to fix the command injection flaw CVE-2018-6021. On the SX-500, enable the update account in the web interface and set its secondary password to block unauthenticated configuration changes under CVE-2018-6020. The SX-500 and SD-320AN are end of life, so plan their replacement.

Flash GEH-SD-320AN firmware 1.14. Silex and GE released version 1.14 to fix CVE-2018-6021 on the GEH-SD-320AN in GE MobileLink.
Enable the update account. On the SX-500, turn on the update account in the web interface and set its secondary password.
Restrict access to the module. Keep the web interface reachable only from management hosts so unauthenticated POST requests cannot arrive from the wider network.
Retire end-of-life modules. The SX-500 reached end of life in 2011 and the SD-320AN in November 2017, so schedule replacements.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface

Contributing

User accounts Hospital network

SX-500 and GEH-500

PID-311 PID-331 Web interface User accounts

SD-320AN and GEH-SD-320AN

PID-27 Field-updatable firmware

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Questions & Answers

Which GE MobileLink Silex modules are affected by CVE-2018-6021?

CISA advisory ICSMA-18-128-01, first published May 8, 2018, lists the Silex Technology GEH-500 (1.54 and earlier), GEH-SD-320AN (GEH-1.1 and earlier), SD-320AN (2.01 and earlier) and SX-500 (all versions) integrated into GE Healthcare MobileLink. CVE-2018-6021 is an OS command injection flaw (CVSS v3 7.4); Silex and GE released firmware version 1.14 for the GEH-SD-320AN.

How do I stop unauthenticated configuration changes on the GE MobileLink SX-500?

For CVE-2018-6020 (CVSS v3 6.5), Silex Technology and GE Healthcare recommend enabling the update account in the SX-500 web interface, which is not enabled by default, and setting the secondary password for that account. The guidance is in CISA advisory ICSMA-18-128-01, published May 8, 2018.

← Back to Vulnerabilities

Key Facts

Product 1: SX-500 and GEH-500 GEH-500 1.54 and earlier; SX-500 all versions (end of life 2011) (Silex Technology)
Device Type: Network module for GE MobileLink
Product 2: SD-320AN and GEH-SD-320AN GEH-SD-320AN GEH-1.1 and earlier; SD-320AN 2.01 and earlier (end of life November 2017) (Silex Technology)
Device Type: Network module for GE MobileLink
Materials: Silex SX-500 module all versions; Silex SD-320AN module ≤ 2.01; GEH-500 ≤ 1.54; GEH-SD-320AN ≤ GEH-1.1, fixed in 1.14
Components: Wireless Module, Operating System, Firmware, Web Application
Interface: TCP
Dataflow: Unauthenticated network client to module via POST requests (system settings changes)
Assets: module system settings (Software Configuration); update account and secondary password (Credentials); GEH-SD-320AN firmware 1.14 (Firmware)
Advisory: ICSMA-18-128-01
CVEs: CVE-2018-6020, CVE-2018-6021
CVSS: 6.5 (v3)
Severity: High
Disclosed: May 8, 2018
Source: CISA ICSMA-18-128-01

Sources

Manufacturers: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

Company pages: Silex Technology · GE HealthCare