Skip to main content

Multiple Vulnerabilities in B. Braun’s Infusion Pump System

Multiple vulnerabilities affecting B. Braun’s infusion pump system could allow an unauthenticated attacker to modify a pump’s configuration, potentially resulting in an unexpected dose being delivered to a patient.

Threat ID:
CC-3930
Threat Severity:
Low
Threat Vector:
Vulnerability
Published:
26 August 2021 12:29 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Multiple vulnerabilities affecting B. Braun’s infusion pump system could allow an unauthenticated attacker to modify a pump’s configuration, potentially resulting in an unexpected dose being delivered to a patient.

Threat details

Introduction

Security researchers have released details, including a proof-of-concept (PoC), of 5 vulnerabilities in B. Braun’s infusion pump system. Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to modify an infusion pump’s configuration while the pump is in standby mode. This could result in an unexpected dose of medication being delivered to a patient.

Vulnerability details

The 5 vulnerabilities are tracked as:

CVE-2021-33882 – Missing Authentication for Critical Function (CVSS v3 6.8)
CVE-2021-33883 – Cleartext Transmission of Sensitive Information (CVSS v3 5.9)
CVE-2021-33884 – Unrestricted Upload of File with Dangerous Type (CVSS v3 6.5)
CVE-2021-33885 – Insufficient Verification of Data Authenticity (CVSS v3 9.0)
CVE-2021-33886 – Improper Input Validation (CVSS v3 6.8)

These vulnerabilities can be used to exploit the Space or compactPlus communication devices to escalate privileges, view sensitive information, upload arbitrary files, and perform remote code execution (RCE). If chained together, the vulnerabilities could allow an unauthenticated attacker to modify a pump’s configuration while the pump is in standby mode.

Threat updates

Date Update
21 Oct 2022 Update to remediation

CISA have updated the remediation portion. This cyber alert has been updated to reflect the new guidance. 
25 Oct 2021 CISA issue ICS Medical Advisory (ICSMA-21-294-01)

CISA has issued ICS Medical Advisory (ICSMA-21-294-01) encouraging affected organisations to review B. Braun's security advisories and apply the necessary updates to affected products.

Remediation advice

Affected organisations are advised to review CISA's ICS Medical Advisory (ICSMA-21-294-01) and the B. Braun Product Security Advisories page to ensure that they are using the latest software updates as follows:

Outside the United States and Canada:

  • Battery Pack SP with Wi-Fi, software 027L000093 (below SN 138853).
  • Battery pack SP with Wi-Fi, software 053L00093 (SN 138853 and higher).
  • SpaceStation with SpaceCom 2, software version 011L000093.

Within the United States and Canada:

  • Battery pack SP with Wi-Fi, software 028U00093 (SN 138852 and lower).
  • Battery pack SP with Wi-Fi, software 054U00093 (SN 138853 and higher).
  • SpaceStation with SpaceCom 2, software Version 012U000093.

In addition, B. Braun recommends users of the affected products consider the following best practices:

  • All facilities utilizing SpaceCom 2, and Battery Pack SP with Wi-Fi should review their IT infrastructure to ensure a network zone concept has been implemented whereby critical systems, such as infusion pumps, are housed in separate (e.g., by firewalls or VLAN) environments that are not accessible directly from the Internet or by unauthorized users.
  • Wireless networks should be implemented using industry standard encryption and should be equipped with intrusion detection systems (IDS) and/or intrusion prevention systems (IPS).

CVE Vulnerabilities

Status Published

CVE-2021-33882

A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands.
Status Published

CVE-2021-33883

A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration.
Status Published

CVE-2021-33884

An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten.
Status Published

CVE-2021-33885

An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets.
Status Published

CVE-2021-33886

An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device.

Last edited: 21 October 2022 4:50 pm