Vulnerability

Spacelabs Xhibit Telemetry Receiver is exposed to the BlueKeep RDP flaw

MedDevice Cyber Staff · Feb 18 · 3 min read · Via CISA ICSMA-20-049-01

CISA published advisory ICSMA-20-049-01 on February 18, 2020, covering the Spacelabs Xhibit Telemetry Receiver (XTR), Model 96280, version 1.0.2. The XTR runs on a Microsoft Windows operating system exposed to BlueKeep, CVE-2019-0708. Microsoft and Spacelabs are credited.

BlueKeep (CVSS v3 9.8) sits in Remote Desktop Services. An unauthenticated attacker connects over RDP and sends crafted requests, with no user interaction, and can then run arbitrary code: install programs, view, change or delete data, or create accounts with full user rights. Pre-authentication flaws of this kind are what worm authors look for.

The XTR is an appliance with no user interface. Customers cannot check the installed software version themselves, so a Spacelabs service representative determines it and coordinates the update.

Spacelabs recommends updating to v1.2.1 or later and says every deployed XTR can be updated. For obsolete or unpatchable Spacelabs products, it offers an alternate mitigation and points to Microsoft's customer guidance for CVE-2019-0708. Support is at 1-800-522-7025, option 2.

A telemetry receiver with RDP open is a Windows server on the clinical network, and it belongs in the same patch inventory as one.

Are you a representative of Spacelabs? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Contact Spacelabs to update every Xhibit Telemetry Receiver to v1.2.1 or later; the appliance has no user interface, so service determines the installed version. Until updated, block RDP to the XTR from everything except required management hosts and apply Microsoft's CVE-2019-0708 guidance.

Book the XTR update. Call Spacelabs at 1-800-522-7025, option 2, to move each unit to v1.2.1 or later.
Block RDP. Filter TCP RDP traffic to the receivers at the network boundary.
Apply Microsoft guidance. Review Microsoft's customer guidance for CVE-2019-0708 for any other Windows systems in the telemetry chain.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system Remote access

Contributing

Off-the-shelf software Physiological waveform processing Hospital network

Xhibit Telemetry Receiver (XTR)

PID-23 PID-41 Named operating system Remote access Off-the-shelf software

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Is the Spacelabs Xhibit Telemetry Receiver vulnerable to BlueKeep?

Yes. CISA advisory ICSMA-20-049-01, published February 18, 2020, says the Spacelabs Xhibit Telemetry Receiver (XTR) Model 96280 version 1.0.2 is affected by BlueKeep, CVE-2019-0708 (CVSS v3 9.8), a pre-authentication RDP remote code execution flaw.

How do I update the Spacelabs XTR for CVE-2019-0708?

Spacelabs recommends updating the Xhibit Telemetry Receiver to v1.2.1 or later. The XTR has no user interface, so a Spacelabs service representative at 1-800-522-7025 confirms the installed version and coordinates the update, per CISA advisory ICSMA-20-049-01 from February 18, 2020.

← Back to Vulnerabilities