Vulnerability

ZOLL Defibrillator Dashboard lets non-admin users upload files that run commands

MedDevice Cyber Staff · Jun 10 · 3 min read · Via CISA ICSMA-21-161-01

CISA published advisory ICSMA-21-161-01 on June 10, 2021, covering six vulnerabilities in ZOLL Defibrillator Dashboard versions before 2.2. An anonymous party reported them.

The worst is CVE-2021-27489 (CWE-434), scored 9.9 under CVSS v3. The web application lets a non-administrative user upload a malicious file that can then execute arbitrary commands remotely. Any logged-in user is enough, and the scope change in the vector reflects that the impact reaches beyond the application.

Three flaws expose secrets, each at 7.1. CVE-2021-27481 (CWE-321) is a hard-coded encryption key in the data exchange process. CVE-2021-27487 (CWE-312) is credentials stored in plaintext. CVE-2021-27485 (CWE-257) lets users store passwords in a recoverable format, which an attacker could pull from the web browser.

The remaining two complete the privilege picture. CVE-2021-27479 (CWE-79, CVSS 4.6) is cross-site scripting that a low privilege user plants for higher privilege users to run, and CVE-2021-27483 (CWE-269, CVSS 5.3) is insecure filesystem permissions that let a lower privilege user escalate to administrator.

ZOLL's fix is version 2.2 or later. It also asks users to turn off browser password autocomplete for the dashboard, to treat the data on the defibrillator itself as the accurate source when the two disagree, and to keep running local readiness checks per the manuals. A fleet dashboard is a convenience layer, and the defibrillator's own self-test remains the record that counts.

Are you a representative of ZOLL? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade ZOLL Defibrillator Dashboard to version 2.2 or later, which fixes all six vulnerabilities including the 9.9 file upload flaw. Disable browser password autocomplete on machines that open the dashboard. Keep treating the defibrillator's own data and local readiness checks as authoritative.

Upgrade to version 2.2 or later. ZOLL Data Products Technical Support can assist with the upgrade.
Turn off password autocomplete. Disable it in every browser used to reach the dashboard, since stored passwords are recoverable.
Keep local readiness checks. Check defibrillators per their manuals and trust the device data over the dashboard if they differ.
Validate uploads server side. Software makers should restrict upload types, store uploads outside executable paths and never run them.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface File import

Contributing

Role-based access User accounts

Defibrillator Dashboard

PID-311 PID-4113 Web interface File import Role-based access User accounts

Fix the class in your product

The server accepts an uploaded file and lets it execute. As the maker, validate type by content, store uploads under a server-generated name in a non-executable location outside the web root, and serve them back through a handler that never interprets them.

Validate by content. Check magic bytes, not the extension; cap size and scan on ingest.
Store inert and non-executable. Server-generated name, no-exec directory, outside the web root.
Never execute an upload. Serve through a handler that returns bytes, never interprets them.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aetherSlide	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Management V15	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
OptimMRI	Rebrain	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
AI Segmentation	Varian	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Cardiologs Holter Platform	Philips	Exposed to the same EMB3D threatTID-319	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer

Questions & Answers

What is CVE-2021-27489 in ZOLL Defibrillator Dashboard?

CVE-2021-27489 (CVSS 9.9) is an unrestricted file upload in ZOLL Defibrillator Dashboard before version 2.2: a non-administrative user can upload a malicious file that executes arbitrary commands remotely. CISA covered it in advisory ICSMA-21-161-01 on June 10, 2021.

Which version of ZOLL Defibrillator Dashboard fixes the ICSMA-21-161-01 vulnerabilities?

ZOLL Defibrillator Dashboard version 2.2 or later fixes all six vulnerabilities in CISA advisory ICSMA-21-161-01, including CVE-2021-27489, CVE-2021-27481 and CVE-2021-27487. ZOLL Data Products Technical Support assists with upgrades.

Should hospitals trust ZOLL Defibrillator Dashboard readiness data?

ZOLL says the data on the defibrillator should be treated as the accurate source if it differs from the Defibrillator Dashboard, and users should keep performing local readiness checks per the manuals, per CISA advisory ICSMA-21-161-01.

← Back to Vulnerabilities