Vulnerability

Smiths Medical CADD-Solis Medication Safety Software hands users elevated SQL database rights

MedDevice Cyber Staff · Nov 1 · 3 min read · Via CISA ICSMA-16-306-01

CISA published advisory ICSMA-16-306-01 on November 1, 2016, covering two vulnerabilities in Smiths Medical CADD-Solis Medication Safety Software versions 1.0, 2.0, 3.0 and 3.1. The software manages the drug libraries that CADD-Solis infusion pumps use.

CVE-2016-8355 (CWE-732, CVSS v3 9.9) is the serious one. The software grants an authenticated user elevated privileges on the SQL database, enough to modify drug libraries, add and delete users and change user permissions. CVE-2016-8358 (CWE-300, CVSS 8.5) means the software does not verify the identities at communication endpoints, which opens the channel to a man-in-the-middle attacker.

A drug library is the dosing guardrail. Anyone who can rewrite it can change the limits a pump enforces, and the CVSS vector puts the attack on the network with low privileges and a changed scope. Smiths Medical said physical access to the pump is required to install drug library updates, which slows the path from a tampered database to a tampered pump.

The fix is Version 3.2 inside the continental US and Version 4.1 outside it. Smiths Medical also asked users to enforce strict password standards with a minimum length of 8 characters, run a managed Active Directory, create a dedicated SQL Express database account with managed permissions, assign managed service accounts for servers and pumps, and use VLAN tagging.

Database permissions are a safety control when the database holds dosing limits, and they belong in the threat model on day one.

Are you a representative of ICU Medical? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade CADD-Solis Medication Safety Software to Version 3.2 (continental US) or Version 4.1 (outside the continental US). Until then, give the application its own SQL Express account with managed permissions and audit who can change drug libraries and user rights. Put the servers and pumps on a tagged VLAN.

Install Version 3.2 or 4.1. Pick the release for your region; both fix CVE-2016-8355 and CVE-2016-8358.
Restrict the database account. Create a dedicated SQL Express account with managed permissions for the software instead of relying on the default grants.
Audit drug library changes. Review recent drug library edits and user permission changes for anything nobody approved.
Segment with VLAN tagging. Keep the medication safety servers and infusion pumps on a separate tagged network segment.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Patient or study database Role-based access

Contributing

User accounts Therapy delivery Hospital network

CADD-Solis Medication Safety Software

PID-4111 PID-332 Patient or study database Role-based access User accounts Therapy delivery

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2016-8355 in Smiths Medical CADD-Solis Medication Safety Software?

CVE-2016-8355 is an incorrect permission assignment (CWE-732, CVSS v3 9.9) in Smiths Medical CADD-Solis Medication Safety Software 1.0, 2.0, 3.0 and 3.1. It grants an authenticated user elevated SQL database privileges, enough to modify drug libraries and change user permissions. CISA advisory ICSMA-16-306-01, published November 1, 2016, lists Versions 3.2 and 4.1 as the fix.

Which CADD-Solis Medication Safety Software version fixes CVE-2016-8358?

Smiths Medical released CADD-Solis Medication Safety Software Version 3.2 for the continental US and Version 4.1 outside it. Both address CVE-2016-8358, the missing endpoint identity check, and CVE-2016-8355, per CISA advisory ICSMA-16-306-01 from November 1, 2016.

← Back to Vulnerabilities