Cybersecurity researchers have disclosed 5 beforehand unreported safety vulnerabilities affecting B. Braun’s Infusomat Area Massive Quantity Pump and SpaceStation that might be abused by malicious events to tamper with remedy doses with none prior authentication.
McAfee, which found and reported the issues to the German medical and pharmaceutical system firm on January 11, 2021, said the “modification may seem as a tool malfunction and be observed solely after a considerable quantity of drug has been allotted to a affected person, for the reason that infusion pump shows precisely what was prescribed, all whereas shelling out probably deadly doses of remedy.”
The problems have been addressed by B. Braun in SpaceCom L82 or later, Battery Pack SP with WiFi:L82 or later, and DataModule compactplus model A12 or later.
Infusion pumps are medical units used to ship intravenous fluids, similar to vitamins and drugs, right into a affected person’s physique in managed quantities, whereas SpaceStation is a configurable docking and communication system designed to accommodate as much as 4 infusion pumps to be used in a medical facility. The units run on a software program element known as SpaceCom, an embedded Linux system that runs both on the pump from inside its good battery pack or from contained in the SpaceStation.
In a nutshell, the issues recognized by McAfee permits an attacker to escalate privileges, view delicate info, add arbitrary information, and carry out distant code execution —
- CVE-2021-33885 – Inadequate Verification of Information Authenticity (CVSS 9.7)
- CVE-2021-33882 – Lacking Authentication for Essential Perform (CVSS 8.2)
- CVE-2021-33886 – Use of Externally-Managed Format String (CVSS 7.7)
- CVE-2021-33883 – Cleartext Transmission of Delicate Info (CVSS 7.1)
- CVE-2021-33884 – Unrestricted Add of File with Harmful Sort (CVSS 5.8)
By chaining collectively the vulnerabilities, an adversary may “modify a pump’s configuration whereas the pump is in standby mode, leading to an surprising dose of remedy being delivered to a affected person on its subsequent use – all with zero authentication,” McAfee Superior Risk Analysis group famous in a technical deep-dive.
Put in another way, the weaknesses, which come up as a result of an absence of verification within the pump’s working system, may permit any attacker to ship instructions or knowledge to it, thereby facilitating distant assaults that not solely go undetected but in addition weaponize the system by altering the quantity of remedy a affected person is predicted to obtain by infusion.
One caveat of word is that the assaults can solely achieve success when a pump is idle or in standby mode in between infusions, to not point out such unauthorized modifications to important pump knowledge necessitate that the risk actor first acquire an preliminary foothold to the native community, or probably perform the intrusions over the web within the occasion the pumps are straight uncovered — a situation that is unlikely.
“All services using SpaceCom, Battery Pack SP with WiFi, and DataModule compactplus ought to evaluate their IT infrastructure to make sure that a community zone idea has been applied whereby important methods, similar to infusion pumps, are housed in separate (e.g., by firewalls or VLAN) environments which aren’t accessible straight from the web or by unauthorized customers,” B. Braun said in an advisory revealed on Might 14, 2021.
“Wi-fi networks needs to be applied utilizing multi-factor authentication and business commonplace encryption and needs to be geared up with Intrusion Detection Programs (IDS) and/or Intrusion Prevention Programs (IPS),” the corporate added.