PwnedPiper PTS Security Flaws Threaten 80% of Hospitals in the U.S.

Cybersecurity researchers on Monday disclosed a set of nine
vulnerabilities known as “PwnedPiper^[1]” that left a widely-used
pneumatic tube system (PTS) vulnerable to critical attacks,
including a possibility of complete takeover.

The security weaknesses, disclosed by American cybersecurity
firm Armis, impact the Translogic PTS system by Swisslog
Healthcare, which is installed in about 80% of all major hospitals
in North America and in no fewer than 3,000 hospitals
worldwide.

“These vulnerabilities can enable an unauthenticated attacker to
take over Translogic PTS stations and essentially gain complete
control over the PTS network of a target hospital,” Armis
researchers Ben Seri and Barak Hadad said. “This type of control
could enable sophisticated and worrisome ransomware attacks, as
well as allow attackers to leak sensitive hospital
information.”

Pneumatic tube systems are internal logistics and transport
solutions that are used to transport blood samples in hospital
settings to diagnostic laboratories securely.

Successful exploitation of the issues, therefore, could result
in leakage of sensitive information, enable an adversary to
manipulate data, and even compromise the PTS network to carry out a
man-in-the-middle (MitM) attack and deploy ransomware, thereby
effectively halting the operations of the hospital.

The details about the nine PwndPiper vulnerabilities are listed
as follows –

• CVE-2021-37161 – Underflow in udpRXThread
• CVE-2021-37162 – Overflow in
  sccProcessMsg
• CVE-2021-37163 – Two hardcoded passwords
  accessible through the Telnet server
• CVE-2021-37164 – Off-by-three stack overflow
  in tcpTxThread
• CVE-2021-37165 – Overflow in
  hmiProcessMsg
• CVE-2021-37166 – GUI socket Denial Of
  Service
• CVE-2021-37167 – User script run by root can
  be used for PE
• CVE-2021-37160 – Unauthenticated, unencrypted,
  unsigned firmware upgrade

In a nutshell, the flaws — which concern privilege escalation,
memory corruption, and denial-of-service — could be abused to gain
root access, achieve remote-code-execution or denial-of-service,
and worse, permit an attacker to maintain persistence on
compromised PTS stations via an insecure firmware upgrade
procedure, leading to unauthenticated remote-code-execution. It’s
also worth noting that a patch for CVE-2021-37160 is expected to be
shipped at a future date.

“The potential for pneumatic tube stations (where the firmware
is deployed) to be compromised is dependent on a bad actor who has
access to the facility’s information technology network and who
could cause additional damage by leveraging these exploits,”
Swisslog Healthcare said^[2]
in an independent advisory published today.

Translogic PTS system customers are highly recommended to update
to the latest firmware (Nexus Control Panel version 7.2.5.7) to
mitigate any potential risk that may arise out of real-world
exploitation of the shortcomings.

“This research sheds light on systems that are hidden in plain
sight but are nevertheless a crucial building block to modern-day
healthcare,” Seri and Hadad said. “Understanding that patient care
depends not only on medical devices, but also on the operational
infrastructure of a hospital is an important milestone to securing
healthcare environments.”