Vulnerability

Stryker ships updates for KRACK Wi-Fi flaws in InTouch, S3 and Secure II hospital beds

MedDevice Cyber Staff · Jan 29 · 2 min read · Via CISA ICSMA-19-029-01

CISA published advisory ICSMA-19-029-01 on January 29, 2019, for three Stryker hospital bed lines with wireless enabled: the InTouch ICU Bed models 2131 and 2141 with Bed Wireless, the S3 MedSurg Bed models 3002 S3 and 3005 S3 with iBed Wireless, and the Secure II MedSurg Bed model 3002 with iBed Wireless.

The flaws are the KRACK key reinstallation attacks against WPA and WPA2. CVE-2017-13077 (CWE-323, CVSS v3 6.8) covers reinstallation of the pairwise key during the four-way handshake; CVE-2017-13078 and CVE-2017-13079 cover the group and integrity group keys. Mathy Vanhoef of imec-DistriNet, KU Leuven, is credited.

Manipulated handshake traffic forces nonce reuse. An attacker within radio range can then replay, decrypt or spoof frames, which CISA says could mean partial disclosure of encrypted communication or injection of data.

Stryker has released software updates for the affected beds and recommends additional defensive measures. Support questions go to 1-800-STRYKER, option 2.

The advisory landed more than a year after KRACK went public, a normal pace for embedded clinical equipment. Beds rarely make the patch list, and their wireless modules still need to be on it.

Are you a representative of Stryker? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Stryker's software updates for wireless-enabled InTouch ICU, S3 MedSurg and Secure II MedSurg beds. Find every bed with Bed Wireless or iBed Wireless enabled first, since those are the units in scope. Keep bed traffic on a segmented wireless network.

Find wireless-enabled beds. List InTouch 2131 and 2141, S3 3002 S3 and 3005 S3, and Secure II 3002 beds with wireless turned on.
Apply Stryker's update. Install the released software update on each affected bed; call 1-800-STRYKER, option 2, for support.
Segment bed traffic. Put bed wireless traffic on its own network segment so injected frames reach as little as possible.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Hospital network

InTouch ICU Bed

Wireless connectivity

S3 MedSurg Bed

Wireless connectivity

Secure II MedSurg Bed

Wireless connectivity

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Stryker beds are affected by the KRACK vulnerability?

CISA advisory ICSMA-19-029-01, published January 29, 2019, lists the Stryker InTouch ICU Bed models 2131 and 2141 with Bed Wireless, the S3 MedSurg Bed models 3002 S3 and 3005 S3 with iBed Wireless, and the Secure II MedSurg Bed model 3002 with iBed Wireless, affected by CVE-2017-13077 and related KRACK CVEs.

Did Stryker release a fix for KRACK in its hospital beds?

Yes. Stryker released software updates for the InTouch ICU, S3 MedSurg and Secure II MedSurg beds to mitigate the KRACK flaws, including CVE-2017-13077, per CISA advisory ICSMA-19-029-01.

← Back to Vulnerabilities