Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Tuesday November 19 2019, @01:36AM   Printer-friendly
from the remove-an-appendix-or-two dept.

Submitted via IRC for SoyCow1337

US-CERT Warns of Remotely Exploitable Bugs in Medical Devices

Vulnerabilities in key surgical equipment could be remotely exploited by a low-skill attacker.

US-CERT has issued an advisory for vulnerabilities in Medtronic's Valleylab FT10 and Valleylab FX8 Energy Platforms, both key surgical equipment that could be remotely exploited by a low-skill attacker. Vulnerabilities also affect Valleylab Exchange Client, officials report.

The advisory details three vulnerabilities. One is the use of hard-coded credentials (CVE-2019-13543). Affected devices use multiple sets of hard-coded credentials; if discovered, they could be used to read files on the equipment. The flaw has been assigned a CVSS base score of 5.8.

These products also use a reversible one-way hash for OS password hashing. While interactive, network-based logons are disabled. An attacker could use other vulnerabilities disclosed to gain local shell access and obtain these hashes. This flaw (CVE-2019-13539) has a CVSS score of 7.0.

Improper input validation (CVE-2019-3464 and CVE-2019-3463) marks the third type of vulnerability. The affected devices use a vulnerable version of the rssh utility to enable file uploads, which could give an attacker administrative access to files or the ability to execute arbitrary code. This vulnerability has been given a CVSS score of 9.8.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.