Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.4211
Advisory (icsma-19-311-02) Medtronic Valleylab FT10 and FX8
8 November 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Medtronic Valleylab FT10 and FX8
Publisher: ICS-CERT
Operating System: Windows
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Access Confidential Data -- Remote/Unauthenticated
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-13543 CVE-2019-13539 CVE-2019-3464
CVE-2019-3463
Reference: ESB-2019.1253
ESB-2019.0306
Original Bulletin:
https://www.us-cert.gov/ics/advisories/icsma-19-311-02
- --------------------------BEGIN INCLUDED TEXT--------------------
ICS Medical Advisory (ICSMA-19-311-02)
Medtronic Valleylab FT10 and FX8
Original release date: November 07, 2019
Legal Notice
All information products included in http://ics-cert.us-cert.gov are
provided"as is" for informational purposes only. The Department of Homeland
Security (DHS) does not provide any warranties of any kind regarding any
information contained within. DHS does not endorse any commercial product or
service, referenced in this product or otherwise. Further dissemination of this
product is governed by the Traffic Light Protocol (TLP) marking in the header.
For more information about TLP, see http://www.us-cert.gov/tlp/ .
1. EXECUTIVE SUMMARY
o CVSS v3 9.8
o ATTENTION: Exploitable remotely/low skill level to exploit
o Vendor: Medtronic
o Equipment: Valleylab FT10, Valleylab FX8
o Vulnerabilities: Use of Hard-coded Credentials, Reversible One-way Hash,
Improper Input Validation
2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow an attacker to
overwrite files or remotely execute code, resulting in a remote, non-root shell
on the affected products. By default, the network connections on these devices
are disabled. Additionally, the Ethernet port is disabled upon reboot. However,
it is known that network connectivity is often enabled.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Medtronic Valleylab products, are affected:
o Valleylab Exchange Client, Version 3.4 and below
o Valleylab FT10 Energy Platform (VLFT10GEN) software Version 4.0.0 and below
o Valleylab FX8 Energy Platform (VLFX8GEN) software Version 1.1.0 and below
3.2 VULNERABILITY OVERVIEW
3.2.1 USE OF HARD-CODED CREDENTIALS CWE-798
The affected products use multiple sets of hard-coded credentials. If
discovered, they can be used to read files on the device.
CVE-2019-13543 has been assigned to this vulnerability. A CVSS v3 base score of
5.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:C/
C:L/I:N/A:N ).
3.2.2 REVERSIBLE ONE-WAY HASH CWE-328
The affected products use the descrypt algorithm for OS password hashing. While
interactive, network-based logons are disabled, and attackers can use the other
vulnerabilities within this report to obtain local shell access and access
these hashes.
CVE-2019-13539 has been assigned to this vulnerability. A CVSS v3 base score of
7.0 has been calculated; the CVSS vector string is ( AV:L/AC:H/PR:L/UI:N/S:U/
C:H/I:H/A:H ).
3.2.3 IMPROPER INPUT VALIDATION CWE-20
The affected products use a vulnerable version of the rssh utility in order to
facilitate file uploads. This could provide an attacker with administrative
access to files or the ability to execute arbitrary code.
CVE-2019-3464 , and CVE-2019-3463 have been assigned to this vulnerability. A
CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N
/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ).
3.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
o COUNTRIES/AREAS DEPLOYED: Worldwide
o COMPANY HEADQUARTERS LOCATION: Ireland
3.4 RESEARCHER
Medtronic reported these vulnerabilities to CISA.
4. MITIGATIONS
Software patches are currently available for the FT10 platform and will be
available in early 2020 for the FX8 platform. Until these updates can be
applied, Medtronic recommends to either disconnect affected products from IP
networks or to segregate those networks, such that the devices are not
accessible from an untrusted network (e.g., Internet). Patches can be
downloaded at the following location:
https://www.medtronic.com/covidien/en-us/support/software.html
Medtronic has released additional patient focused information, at the following
location:
https://www.medtronic.com/security
CISA recommends users take defensive measures to minimize the risk of
exploitation of these vulnerabilities. Specifically, users should:
o Minimize network exposure for all medical devices and/or systems.
o Locate medical devices behind firewalls and isolate them where possible.
o Restrict system access to authorized personnel only and follow a least
privilege approach.
o Apply defense-in-depth strategies.
o Disable any unnecessary accounts, protocols and services.
o Where additional information is needed, refer to existing cybersecurity in
medical device guidance issued by the FDA at the following location: https:
//www.fda.gov/medical-devices/digital-health/cybersecurity
CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage on us-cert.gov . Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on us-cert.gov in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXcSvQ2aOgq3Tt24GAQgorQ//VPP3QkN5rSCSdJxtjdsDZMX4hW9IYzNG
NaTZT4iKpFnnYed6qBIA7AJbc6K+ily0Znq185SxjfoDFiGeRz9gQhcnjBzqvwZg
glszNs0sdT1/OUcbVMOtBjme0skMCtDYSE7va3NfgrMo5EAQ7HrPoDcZbU+a/lXQ
T9TlNuGrH+VSY2xNFueMWRKfQqgVXaZqr6pbGgUHnCYHWvrKPQ6U8TSMzZxo9o/8
ILgbu4e2vBbEOcJx6WuN76kN27eWV0j0dLVI0rOG1QbfFcCj/Xdx0vRkqdfPhB9U
PfVMA+Wz3DW+bQtJBnVM4NZbi2LL2sPprBKKVT9qZV128ElNpCVDrsO0W7A9J6pg
S/rG9xzGrBLRMY0wmpFgLNOn2vXNDXgKeuYY6FzpQNuEkCM5BP5AQeU0X+L9Hnuz
H8y+M5SXi3c+O5Crs9DTILpqIFh4G/bm+YKiVhwoAQ8pHkYmkNst43k9ojGeFzeO
WvWfxzPQqlj+m9ltpNfwVmbpuBeqSRcfOIxRwGHs6Ufqs+ju/BYTB+8sIdylvedD
CqV87aiyvS5nYvFiW+itxc/blrSWmbOqVdtqDsT9g2a2d7d1QuEHB7gZWpoVmso6
yCNH9AHrndROb0Yj0CRgy4Oj9Y3zhx3W/8IPn6BxKV4O5eAJ2pjf1ElkuCVb6s7k
+Ns/bPMZ1m0=
=RJpZ
-----END PGP SIGNATURE-----