CyberzSOC

Publication detail
← Back to advisories & guidance

ICSMA-24-151-02: Baxter Welch Allyn Connex Spot Monitor ↗ source

May 30, 2024 CISA ICS Medical Advisory
Source: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-151-02

Summary

Successful exploitation of this vulnerability could allow an attacker to modify device configuration and firmware data. Tampering with this data could lead to device compromise, resulting in impact and/or delay in patient care. CVE-2024-1275: The impacted product uses a default cryptographic key for potentially critical functionality. An attacker could modify device configurations and firmware data, resulting in impact and/or delay in patient care

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSMA-24-151-02
Status
Final · version 1
Initial release
2024-05-30
Last revised
2024-05-30
Vendor
Baxter
Critical infrastructure sectors
Healthcare and Public Health
Deployed
Worldwide
Vendor headquarters
United States

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Credit: Maarten Boone, Edwin Van Andel (CTO of Zerocopter)

Affected products (1)
  • Welch Allyn Connex Spot Monitor (CSM) — <=1.52

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2024-1275 CWE-1394 Use of Default Cryptographic Key 7.4 High The impacted product uses a default cryptographic key for potentially critical functionality. An attacker could modify device configurations and firmware data, resulting in impact and/or delay in patient care

Mitigation: Baxter has released a software update for all impacted devices and software to address this vulnerability. A new version of the product that mitigates the vulnerability is available as follows:

Mitigation: Welch Allyn Connex Spot Monitor: Version 1.52.01 (available October 16, 2023)

Mitigation: Baxter recommends users upgrade to the latest versions of their products. Information on how to update products to their new versions can be found on the Baxter disclosure page or the Hillrom disclosure page. ↗

Affected, fixed & timeline

Affected:

  • Welch Allyn Connex Spot Monitor (CSM) <=1.52

Mitigation: Baxter recommends users upgrade to the latest versions of their products. Information on how to update products to their new versions can be found on the Baxter disclosure page or the Hillrom disclosure page.

Mitigation: Baxter recommends the following workarounds to help reduce risk:

Mitigation: Apply proper network and physical security controls.

Mitigation: Ensure a unique encryption key is configured and applied to the product (as described in the Connex Spot Monitor Service Manual).

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2024-1275 9.1 Critical Baxter Welch Allyn Connex Spot Monitor Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue …

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.