Two medium severity vulnerabilities have been identified in Hillrom medical device management tools which could result in the leakage of sensitive data, corruption of data, and remote code execution.
An out-of-bounds write vulnerability – tracked as CVE-2021-27410 – could allow an attacker to cause memory corruption which would allow the remote execution of arbitrary code. While remote code execution is possible, exploiting the flaw is highly complex. The flaw has been assigned a CVSS v3 severity score of 5.9 out of 10.
The second flaw is an out-of-bounds read issue that could result in information leakage and arbitrary code execution if combined with the out-of-bounds write vulnerability. The flaw is tracked as CVE-2021-27408 and has been assigned a CVSS severity score of 5.9.
The flaws affected the following Hillrom Welch Allyn medical device management tools:
- Welch Allyn Service Tool: versions prior to v1.10
- Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3
- Welch Allyn Software Development Kit (SDK): versions prior to v3.2
- Welch Allyn Connex Central Station (CS): versions prior to v1.8.6
- Welch Allyn Service Monitor: versions prior to v1.7.0.0
- Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02
- Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02
- Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52
- Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00
The vulnerabilities were identified by Itamar Cohen-Matalon of Medigate Reserach Labs who reported the vulnerabilities to Hillrom. Hillrom has now released software updates to correct the flaws. Customers are advised to upgrade to the latest versions of the software to fix the flaws to prevent exploitation. At present, there are no reported cases of exploitation of the vulnerabilities.
Product versions with the vulnerabilities corrected are listed below:
- Welch Allyn Service Tool: v1.10
- Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): v5.3 (available Summer 2021)
- Welch Allyn Software Development Kit (SDK): v3.2
- Welch Allyn Connex Central Station (CS): v1.8.6 (available Fall 2021)
- Welch Allyn Service Monitor: v1.7.0.0
- Welch Allyn Connex Vital Signs Monitor (CVSM): v2.43.02
- Welch Allen Connex Integrated Wall System (CIWS): v2.43.02
- Welch Allyn Connex Spot Monitor (CSM): v1.52
- Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: v1.11.00 (available Fall 2021)
Hillrom also recommends applying proper network and physical security controls, applying authentication for server access, and applying data execution prevention (DEP) where possible to prevent shellcode from running.
The post Vulnerabilities Identified in Hillrom Medical Device Management Products appeared first on HIPAA Journal.