Hillrom Medical Device Management has announced that two vulnerabilities have been identified in certain Welch Allyn medical devices. If exploited the vulnerabilities could allow an unauthorized attacker to compromise software security by executing commands, gaining privileges, and reading sensitive information while evading detection.
The vulnerabilities affect the following Hillrom products:
- Welch Allyn ELI 380 Resting Electrocardiograph (versions 2.6.0 and prior)
- Welch Allyn ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph (versions 2.3.1 and prior)
- Welch Allyn ELI 250c/BUR 250c Resting Electrocardiograph (versions 2.1.2 and prior)
- Welch Allyn ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph (versions 2.2.0 and prior)
The two vulnerabilities were discovered by an anonymous researcher who reported to Hillrom. The most serious vulnerability – tracked as CVE-2022-26389 – has a CVSS v3 severity score of 7.7 out of 10 (high severity), and is due to improper access controls for restricting attempts at accessing resources by unauthorized individuals.
The second vulnerability – tracked as CVE-2022-26388 – has been assigned a CVSS v3 severity score of 6.4 out of 10 (medium severity) and is due to the use of hard-coded credentials for inbound authentication and outbound communication to external components.
Hillrom released a patch to fix the flaw in May 2022 for the Welch Allyn ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph, and patches are scheduled to be released to address the vulnerabilities in the Welch Allyn ELI 380 and ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph devices by Q4, 2023.
The patches should be applied as soon as possible to prevent the exploitation of the flaws. If a patch is not yet available, Hillrom recommends applying the proper network and physical security controls to reduce risk:
- Ensure a unique encryption key is configured for ELI Link and Cardiograph.
- Where possible, use a firewall to prevent communication on Port 21 FTP service, Port 22 SSH (Secure Shell Connection), and Port 23 Telnet service.
The post Vulnerabilities Identified in Welch Allyn Resting Electrocardiograph Devices appeared first on HIPAA Journal.