4.9 Medium
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:A/AC:M/Au:S/C:P/I:P/A:P
6.3 Medium
CVSS3
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
10.6%
CVSS v3 6.3
ATTENTION: Exploitable from adjacent network
Vendor: Becton, Dickinson and Company (BD)
Equipment: BD Kiestra and InoqulA systems
Vulnerabilities: Product UI does not Warn User of Unsafe Actions
This updated advisory is a follow-up to the original advisory titled ICSMA-18-142-01 BD Kiestra and InoquIA Systems that was published May 22, 2018, on the NCCIC/ICS-CERT website.
Successful exploitation of these vulnerabilities may lead to loss or corruption of data.
BD reports these vulnerabilities affect applications used by the following BD Kiestra systems:
All three BD Kiestra systems listed above use the following vulnerable applications:
A vulnerability in DB Manager and PerformA allows an authorized user with access to a privileged account on a BD Kiestra system to issue SQL commands, which may result in data corruption.
CVE-2018-10593 has been assigned to this vulnerability. A CVSS v3 base score of 5.6 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H).
A vulnerability in ReadA allows an authorized user with access to a privileged account on a BD Kiestra system to issue SQL commands, which may result in loss or corruption of data.
CVE-2018-10595 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
BD discovered these vulnerabilities and reported them to NCCIC.
--------- Begin Update A Part 1 of 1 --------
BD has developed a mitigation to prevent authorized users with access to a privileged account on a BD Kiestra system from triggering SQL functions. This mitigation also remediates a limited set of ePHI patient data that can be exposed when a privileged user executes a select SQL statement in the ReadA Overview. BD is in the process of deploying the mitigation remotely or on premise, depending on user preference.
--------- End Update A Part 1 of 1 ----------
Until mitigations are in place, BD recommends the following compensating controls. These controls require user action in order to reduce risk associated with these vulnerabilities:
For product support or site-specific concerns, users in North America may contact Lab Automation Regional Phone Support via email [email protected] or by phone (1-800-638-8663). Users in EMEA may contact Customer Service Desk via email [email protected] or by phone (+31 512 540 623).
For more specific details regarding these vulnerabilities, the associated mitigations, and links to user manuals, please see the BD Product Security Bulletin at the following location:
<https://www.bd.com/en-us/support/product-security-and-privacy>
NCCIC recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
NCCIC also recommends that users take the following measures to protect themselves from social engineering attacks:
No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely. High skill level is needed to exploit.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10593
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10595
cwe.mitre.org/data/definitions/356.html
cwe.mitre.org/data/definitions/356.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=BD%20Kiestra%20and%20InoquIA%20Systems%20%28Update%20A%29+https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-142-01
www.bd.com/en-us/support/product-security-and-privacy
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-142-01&title=BD%20Kiestra%20and%20InoquIA%20Systems%20%28Update%20A%29
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-142-01
www.oig.dhs.gov/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-142-01
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=BD%20Kiestra%20and%20InoquIA%20Systems%20%28Update%20A%29&body=www.cisa.gov/news-events/ics-medical-advisories/icsma-18-142-01
4.9 Medium
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:A/AC:M/Au:S/C:P/I:P/A:P
6.3 Medium
CVSS3
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
10.6%