B.Braun Infusomat Pumps Could Let Attackers Remotely Alter Medication Dosages

Cybersecurity researchers have disclosed five previously
unreported security vulnerabilities affecting B. Braun’s Infusomat
Space Large Volume Pump and SpaceStation that could be abused by
malicious parties to tamper with medication doses without any prior
authentication.

McAfee, which discovered and reported the flaws to the German
medical and pharmaceutical device company on January 11, 2021,
said^[1]
the “modification could appear as a device malfunction and be
noticed only after a substantial amount of drug has been dispensed
to a patient, since the infusion pump displays exactly what was
prescribed, all while dispensing potentially lethal doses of
medication.”

The issues have been addressed by B. Braun in SpaceCom L82 or
later, Battery Pack SP with WiFi:L82 or later, and DataModule
compactplus version A12 or later.

Infusion pumps are medical devices used to deliver intravenous
fluids, such as nutrients and medications, into a patient’s body in
controlled amounts, while SpaceStation is a configurable docking
and communication system designed to accommodate up to four
infusion pumps for use in a medical facility. The devices run on a
software component called SpaceCom, an embedded Linux system that
runs either on the pump from within its smart battery pack or from
inside the SpaceStation.

In a nutshell, the flaws identified by McAfee enables an
attacker to escalate privileges, view sensitive information, upload
arbitrary files, and perform remote code execution —

• CVE-2021-33885 – Insufficient Verification of
  Data Authenticity (CVSS 9.7)
• CVE-2021-33882 – Missing Authentication for
  Critical Function (CVSS 8.2)
• CVE-2021-33886 – Use of Externally-Controlled
  Format String (CVSS 7.7)
• CVE-2021-33883 – Cleartext Transmission of
  Sensitive Information (CVSS 7.1)
• CVE-2021-33884 – Unrestricted Upload of File
  with Dangerous Type (CVSS 5.8)

By chaining together the vulnerabilities, an adversary could
“modify a pump’s configuration while the pump is in standby mode,
resulting in an unexpected dose of medication being delivered to a
patient on its next use – all with zero authentication,” McAfee
Advanced Threat Research team noted in a technical deep-dive.

Put differently, the weaknesses, which arise due to a lack of
verification in the pump’s operating system, could allow any
attacker to send commands or data to it, thereby facilitating
remote attacks that not only go undetected but also weaponize the
device by altering the amount of medication a patient is expected
to receive through infusion.

One caveat of note is that the attacks can only be successful
when a pump is idle or in standby mode in between infusions, not to
mention such unauthorized modifications to critical pump data
necessitate that the threat actor first gain an initial foothold to
the local network, or potentially carry out the intrusions over the
internet in the event the pumps are directly exposed — a scenario
that’s unlikely.

“All facilities utilizing SpaceCom, Battery Pack SP with WiFi,
and DataModule compactplus should review their IT infrastructure to
ensure that a network zone concept has been implemented whereby
critical systems, such as infusion pumps, are housed in separate
(e.g., by firewalls or VLAN) environments which are not accessible
directly from the internet or by unauthorized users,” B. Braun
said^[2]
in an advisory published on May 14, 2021.

“Wireless networks should be implemented using multi-factor
authentication and industry standard encryption and should be
equipped with Intrusion Detection Systems (IDS) and/or Intrusion
Prevention Systems (IPS),” the company added.