Vulnerability

Swisslog Translogic Nexus Control Panel ships hard-coded root passwords and unvalidated updates

MedDevice Cyber Staff · Aug 3 · 4 min read · Via CISA ICSMA-21-215-01

CISA published advisory ICSMA-21-215-01 on August 3, 2021, for the Nexus Control Panel used in Swisslog Healthcare's Translogic pneumatic tube system (PTS). Barak Hadad and Ben Seri of Armis reported eight vulnerabilities affecting versions earlier than 7.2.5.7. Six carry a CVSS v3 base score of 9.8.

CVE-2021-37163 (CWE-259, CVSS 9.8) is the headline. User and root accounts on the panel have hard-coded passwords that can be reached remotely, the accounts are on by default, and native configuration cannot turn them off. CVE-2021-37167 (CVSS 8.8) adds that a user logged in with those default credentials can gain root access to the device.

The memory bugs need no credentials at all. CVE-2021-37161 and CVE-2021-37162 (integer underflow) let an attacker overwrite an internal queue data structure, CVE-2021-37165 overflows on a crafted message to the HMI, and CVE-2021-37164 (CWE-787) copies received data into a stack buffer. Each could allow remote code execution and each scores 9.8.

CVE-2021-37166 (CWE-287, CVSS 9.8) concerns how a local service binds to ports on the device interfaces, which may let an external attacker hijack the connection. CVE-2021-37160 (CWE-494, CVSS 7.5) is the update path: there is no file validation when an update is uploaded.

Swisslog said version 7.2.5.7 fixes every listed vulnerability except CVE-2021-37160, and recommends running the latest version together with its mitigation methods. Armis published detection practices to identify and block exploitation attempts.

Pneumatic tube stations move specimens and medications around a hospital, so they rarely make the medical device inventory. A root password nobody can change, on a networked controller that accepts unsigned updates, is enough reason to put them there.

Are you a representative of Swisslog Healthcare? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade every Translogic Nexus Control Panel to 7.2.5.7 or later, which fixes seven of the eight CVEs. CVE-2021-37160 stays open, so apply Swisslog's mitigation methods and control who can push updates to the panels. Use the Armis detection practices to watch for exploitation attempts on the PTS network.

Upgrade to 7.2.5.7. Install Nexus Control Panel 7.2.5.7 or later on every Translogic station.
Lock down the update path. Allow update uploads to panels only from a named service host, since CVE-2021-37160 is not fixed.
Segment the PTS. Put Translogic panels on their own network segment with no route from guest or business networks.
Add the PTS to the device inventory. Track Nexus panels with the same patch and monitoring process as clinical devices.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Field-updatable firmware Hospital network

Translogic PTS Nexus Control Panel

PID-3321 PID-271 PID-41 User accounts Field-updatable firmware

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Monaco RTP System	Elekta	Exposed to the same EMB3D threatTID-327	No feedback feed from manufacturer
LOGIQ e	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
CT Collaboration Live	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Image Management V15	Philips	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ARIA Radiation Therapy Management	Varian	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

Questions & Answers

What is CVE-2021-37163 in the Swisslog Translogic Nexus Control Panel?

CVE-2021-37163 is a hard-coded password flaw (CWE-259, CVSS v3 9.8) in the Swisslog Healthcare Translogic Nexus Control Panel before 7.2.5.7. User and root accounts have hard-coded passwords that can be accessed remotely, are enabled by default and cannot be turned off. CISA disclosed it in advisory ICSMA-21-215-01 on August 3, 2021.

Does Nexus Control Panel 7.2.5.7 fix all the Translogic PTS vulnerabilities?

No. Per CISA advisory ICSMA-21-215-01, Swisslog Nexus Control Panel 7.2.5.7 fixes all eight listed vulnerabilities except CVE-2021-37160, the missing file validation on update uploads, which needs Swisslog's mitigation methods.

Who discovered the Swisslog Translogic pneumatic tube vulnerabilities?

Barak Hadad and Ben Seri of Armis reported the eight Swisslog Translogic Nexus Control Panel vulnerabilities in CISA advisory ICSMA-21-215-01, published August 3, 2021.

← Back to Vulnerabilities