Vulnerability

Smiths Medical Medfusion 4000 syringe pump ships hard-coded wireless, FTP and Telnet credentials

MedDevice Cyber Staff · Sep 7 · 4 min read · Via CISA ICSMA-17-250-02A

CISA's advisory on the Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, published September 7, 2017 as ICSMA-17-250-02 and revised as Update A, lists eight vulnerabilities in pump versions 1.1, 1.5 and 1.6. Smiths Medical released version 1.6.1 to mitigate them.

CVE-2017-12725 (CWE-798, CVSS v3 9.8) heads the list. With the default network configuration, the pump uses hard-coded credentials to automatically establish a wireless network connection. It does this even while Ethernet is connected and active, although traffic then runs over the wired link.

FTP is a second path in. CVE-2017-12720 (CWE-284) says the pump's FTP server requires no authentication when the pump is configured to allow FTP connections, and CVE-2017-12724 (CWE-798) says the same server contains hard-coded credentials that are not fully initialized. Telnet uses hard-coded credentials as well (CVE-2017-12726, CVSS 5.6), usable when the pump is configured to allow external communications. Smiths Medical assesses that files cannot be uploaded over Telnet and that the impact stays in the communications module.

The remaining five involve a third-party component and the pump's TLS and configuration handling. A buffer overflow in a third-party component allows remote code execution (CVE-2017-12718, CVSS 8.1), though the pump receives the malicious input infrequently and under certain conditions. An out-of-bounds read in a third-party component crashes the communications module (CVE-2017-12722, CVSS 5.3), which Smiths Medical says would not affect the therapeutic module. The pump does not validate the host certificate (CVE-2017-12721, CVSS 7.5) and stores some passwords in its configuration file (CVE-2017-12723, CVSS 3.7).

A shared credential in the radio means the whole installed base joins a network with the same secret, so recovering it from one pump exposes them all. ICS-CERT asked users to examine their specific clinical use of the pump before choosing defensive measures.

A pump that carries a working wireless login out of the box is on a network before anyone has configured it, which is the wrong default for an infusion device.

Are you a representative of ICU Medical? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update Medfusion 4000 pumps running versions 1.1, 1.5 or 1.6 to version 1.6.1, which Smiths Medical released to mitigate all eight vulnerabilities. Until every pump is updated, keep FTP and external communications switched off in the pump configuration and isolate the pumps on their own network segment. Contact Smiths Medical Technical Support for the update.

Install version 1.6.1. Smiths Medical released Medfusion 4000 version 1.6.1 to mitigate the hard-coded credential, FTP, Telnet, certificate and memory flaws.
Turn off FTP and external communications. The FTP and Telnet flaws are reachable only when the pump is configured to allow those connections.
Segment the pumps. Place pumps on a dedicated wireless network and block their traffic from reaching or being reached by other clinical systems.
Review clinical use before changes. ICS-CERT asked users to examine their specific clinical use of the pump before deploying defensive measures.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Therapy delivery Wired network Off-the-shelf software

Medfusion 4000 Wireless Syringe Infusion Pump

PID-331 Wireless connectivity Wired network Therapy delivery Off-the-shelf software

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Versana Active	GE HealthCare	Same attributes (interface and component types)Ethernet, Wireless Module	No feedback feed from manufacturer
iBed Wireless with iBed Mobile	Stryker	Same attributes (interface and component types)WiFi, Wireless Module	No feedback feed from manufacturer
Infinity CentralStation Wide	Dräger	Same signals	No feedback feed from manufacturer
Zio AT device	iRhythm	Same signals	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Same signals	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-316	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-316	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-316	No feedback feed from manufacturer

Questions & Answers

What is CVE-2017-12725 in the Smiths Medical Medfusion 4000 syringe pump?

CVE-2017-12725 (CWE-798, CVSS v3 9.8) means the Medfusion 4000 Wireless Syringe Infusion Pump, versions 1.1, 1.5 and 1.6, uses hard-coded credentials to automatically establish a wireless network connection under its default network configuration. CISA covered it in advisory ICSMA-17-250-02, published September 7, 2017.

Which Medfusion 4000 version fixes the hard-coded credential vulnerabilities?

Smiths Medical released Medfusion 4000 version 1.6.1 to mitigate the eight vulnerabilities in versions 1.1, 1.5 and 1.6, including hard-coded wireless, FTP and Telnet credentials, per CISA advisory ICSMA-17-250-02A.

Does the Medfusion 4000 FTP server require authentication?

No. Under CVE-2017-12720, the Medfusion 4000 pump's FTP server does not require authentication if the pump is configured to allow FTP connections, and CVE-2017-12724 adds hard-coded FTP credentials. Version 1.6.1 addresses both, per CISA advisory ICSMA-17-250-02A.

← Back to Vulnerabilities