High ICSMA-23-194-01 8 CVEs

BD Alaris System with Guardrails Suite MX

Published Jul 13, 2023 · Updated Oct 26, 2023 · Revision 2

Vendor: Becton, Dickinson and Company (BD) Product: BD Alaris Guardrails Editor Product: BD Alaris Point-of-Care Unit (PCU) Model 8015 Product: BD Alaris Systems Manager Product: Calculation Services Product: CQI Reporter

Summary

Successful exploitation of these vulnerabilities could allow an attacker to compromise sensitive data, hijack a session, modify firmware, make changes to system configurations, among other system impacts.

Vulnerabilities 8

Critical 9.8

CVE-2018-1285 Public exploit EPSS 18%

XML External Entity attack in log4net

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

log4net log4net log4net Debian Ubuntu NuGet

May 11, 2020
High 8.2

CVE-2023-30563

Stored Cross-Site Scripting on User Import Functionality

A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.

Becton Dickinson & Co BD Alarisâ„¢ Systems Manager

Jul 13, 2023
Medium 6.9

CVE-2023-30564

Stored Cross-Site Scripting on Device Import Functionality

Alaris Systems Manager does not perform input validation during the Device Import Function.

Becton Dickinson & Co BD Alarisâ„¢ Systems Manager

Jul 13, 2023
Medium 6.8

CVE-2023-30560

PCU Configuration Lacks Authentication

The configuration from the PCU can be modified without authentication using physical connection to the PCU.

Becton Dickinson & Co BD Alarisâ„¢ Point-of-Care Unit (PCU) Model 8015

Jul 13, 2023
Medium 6.1

CVE-2023-30561

Lack of Cryptographic Security of IUI Bus

The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a specially crafted device while an infusion is running.

Becton Dickinson & Co BD Alarisâ„¢ Point-of-Care Unit (PCU) Model 8015

Jul 13, 2023
Medium 5.2

CVE-2023-30559

Wireless Card Firmware Improperly Signed

The firmware update package for the wireless card is not properly signed and can be modified.

Becton Dickinson & Co BD Alaris™ Point-of-Care Unit (PCU) Model 8015

Jul 13, 2023
Low 3.5

CVE-2023-30565

CQI Data Sniffing

An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.

Becton Dickinson & Co CQI Reporter

Jul 13, 2023
Low 3.0

CVE-2023-30562

Lack of Dataset Integrity Checking

A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.

Becton Dickinson & Co BD Alarisâ„¢ Guardrailsâ„¢ Editor

Jul 13, 2023

Revision history

2023-10-26 #2
Update A - Updates to Mitigations (BD has released BD Alaris System 12.3, which remediates CVE-2018-1285, CVE-2023-30563, CVE-2023-30564, and CVE-2023-30565 and partially remediates CVE-2023-30562)
2023-07-13 #1
Initial Publication

References

ICSA Advisory ICSMA-23-194-01 - Web Version
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-194-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B