Vulnerability

SOOIL Dana Diabecare RS insulin pump and apps can be spoofed and bypassed over Bluetooth

MedDevice Cyber Staff · Jan 12 · 4 min read · Via CISA ICSMA-21-012-01

CISA published advisory ICSMA-21-012-01 on January 12, 2021, covering nine vulnerabilities in the SOOIL Dana Diabecare RS insulin pump and its AnyDana-i and AnyDana-A mobile apps, all versions before 3.0. Julian Suleder, Birk Kauer, Raphael Pavlidis and Nils Emmerich of ERNW Research, with Germany's BSI, reported them.

Most of the set breaks the Bluetooth Low Energy link between pump and app. The protocol uses deterministic keys that a nearby attacker can brute-force (CVE-2020-27264, CVSS v3 7.6, the highest score). Keys are not adequately protected in transit (CVE-2020-27270), the pump is not authenticated before key exchange (CVE-2020-27272), and the communicating entities are not authenticated either (CVE-2020-27276).

Two client-side control flaws (CVE-2020-27266 and CVE-2020-27268, both CVSS 6.5) let a nearby attacker bypass user authentication and default PIN checks. The protocol also lacks replay protection (CVE-2020-27269), and the pump's keypad lock PIN can be extracted over BLE without authentication (CVE-2020-27258).

One flaw needs no radio. CVE-2020-27256 (CWE-798, CVSS 4.6) is a hard-coded physician PIN in the pump's physician menu, which lets someone holding the pump change insulin therapy settings.

The advisory spells out the stakes: access to sensitive information, modified therapy settings, bypassed authentication or a crashed device, all with patient safety implications. SOOIL recommends updating the pump to version 3.0 or later and updating AnyDana-A and AnyDana-i to 3.0 or later immediately.

Security checks that run only in the phone app protect nothing, because an attacker in radio range simply skips the app.

Are you a representative of SOOIL Developments Co, Ltd.? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the Dana Diabecare RS pump to version 3.0 or later and update the AnyDana-A and AnyDana-i apps to 3.0 or later immediately. Until the pump is updated, keep it in the patient's physical control and pair it only in private settings.

Update the pump to 3.0. Arrange the firmware update through SOOIL or the distributor.
Update both apps. Install AnyDana-A or AnyDana-i 3.0 or later on every paired phone.
Keep the pump in hand. The physician PIN flaw needs physical access, so the pump should not be left unattended.
Pair in private. Perform Bluetooth pairing away from crowds to cut the window for key sniffing.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Therapy delivery Wireless connectivity Mobile app

Contributing

Home use Closed-loop control

Dana Diabecare RS

PID-3321 PID-4113 Therapy delivery Wireless connectivity

AnyDana-i / AnyDana-A

Mobile app

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Omnipod 5 ACE Pump	Insulet	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Basal-IQ Technology	Tandem Diabetes Care	Same attributes (interface and component types)BLE, Mobile Application	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Same signals	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same signals	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Same signals	No feedback feed from manufacturer
MULTIX Impact, MULTIX Impact C	Siemens Healthineers	Same signals	No feedback feed from manufacturer
Connected OR Hub with Device and Voice Control	Stryker	Same signals	No feedback feed from manufacturer

Questions & Answers

What is CVE-2020-27264 in the Dana Diabecare RS insulin pump?

CVE-2020-27264 (CWE-330, CVSS v3 7.6) means the communication protocol between the SOOIL Dana Diabecare RS insulin pump and its AnyDana-i and AnyDana-A apps uses deterministic keys, which a physically proximate attacker can brute-force over Bluetooth Low Energy. CISA published it in ICSMA-21-012-01 on January 12, 2021.

Which Dana Diabecare RS version fixes the Bluetooth vulnerabilities?

SOOIL recommends updating the Dana Diabecare RS insulin pump and the AnyDana-A and AnyDana-i apps to version 3.0 or later to fix the vulnerabilities in CISA advisory ICSMA-21-012-01, published January 12, 2021.

Can the Dana Diabecare RS physician PIN be bypassed?

Yes. CVE-2020-27256 (CVSS 4.6) is a hard-coded physician PIN in the SOOIL Dana Diabecare RS physician menu that lets someone with physical access change insulin therapy settings, per CISA advisory ICSMA-21-012-01 from January 12, 2021. Version 3.0 addresses it.

← Back to Vulnerabilities