CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
60.7%
CVSS v3 10.0
ATTENTION: Remotely exploitable/low skill level to exploit
Vendor: (BD) Becton, Dickinson and Company
Equipment: Alaris Gateway Workstation
Vulnerabilities: Improper Access Control, Unrestricted Upload of File with Dangerous Type
Exploitation of these vulnerabilities could allow unauthorized arbitrary code execution, which could allow an attacker to view and edit device status and configuration details as well as cause devices to become unavailable. The vendor has stated the affected products are not sold in the United States.
The following versions of BD’s Alaris Gateway Workstation are affected:
For the Alaris Gateway Workstation Web Browser User Interface vulnerability:
This does not impact the latest firmware Versions 1.3.2 and 1.6.1
For the Alaris Gateway Workstation Dangerous File Upload vulnerability:
This does not impact the latest firmware Versions 1.3.2 and 1.6.1
Additionally, this notification applies to the following products using software Version 2.3.6 and below:
Only software versions for 2.3.6 and below are impacted. Software Version 2.3.6 was released in 2006. These pumps were previously sold under the Asena brand. This does not apply to Alaris Medley devices.
The web browser user interface on the Alaris Gateway Workstation does not prevent an attacker with knowledge of the IP address of the Alaris Gateway Workstation terminal to gain access to the status and configuration information of the device.
CVE-2019-10962 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
The application does not restrict the upload of malicious files during a firmware update.
CVE-2019-10959 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H).
Elad Luz of CyberMDX reported these vulnerabilities to NCCIC.
BD recommends the following mitigations and compensating controls in order to reduce risk associated with these vulnerabilities.
For the Alaris Gateway Workstation Web Browser User Interface vulnerability:
For the Alaris Gateway Workstation Dangerous File Upload vulnerability:
BD is currently assessing additional remediation efforts, including an adjustment to restrict the SMB protocol.
For more information on BD’s product security and vulnerability management, contact BD’s Product Security Office at:
<https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins>
NCCIC recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
<https://www.fda.gov/MedicalDevices/DigitalHealth/ucm373213.htm>
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10959
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10962
cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?product=https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-164-01
cwe.mitre.org/data/definitions/284.html
cwe.mitre.org/data/definitions/434.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=BD%20Alaris%20Gateway%20Workstation+https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-164-01
www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-164-01&title=BD%20Alaris%20Gateway%20Workstation
www.fda.gov/MedicalDevices/DigitalHealth/ucm373213.htm
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-164-01
www.oig.dhs.gov/
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=BD%20Alaris%20Gateway%20Workstation&body=www.cisa.gov/news-events/ics-medical-advisories/icsma-19-164-01
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
60.7%