A syringe pump is a small infusion pump that delivers liquids, either medication or nutrients, in small quantities into the patient’s system. Hospitals, nursing homes, and homes with residents under acute or palliative care use them. Accurate and safe delivery of dosage from a variety of syringes make such a device essential. Unfortunately, a particular model of a wireless smart pump is found to be so vulnerable that a malicious, highly skilled attacker can compromise its communications and therapeutic modules, which in turn could also compromise a patient’s well-being.
Late last week, the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) released an advisory for the Medfusion 4000 Wireless Syringe Infusion Pump after Scott Gayou, an independent security researcher, brought to light multiple vulnerabilities in the device that can be exploited remotely.
According to Gayou, the said syringe pump has problems with the way it processes data, which could then lead to either the unauthorized execution of code or a system crash. He also pointed out that several credentials are hard-coded to the pump, with some even accessible to anyone if the pump’s communication module is modified. Furthermore, the pump is incapable of validating certificates, making it a good candidate for MiTM attacks, allowing threat actors to bypass any security measures in place and gain elevated privileges on it.
Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, and 1.6 are affected by these vulnerabilities.
Smiths Medical, makers of the said smart pump, has announced that they’ll be releasing version 1.6.1 of the product to address the vulnerabilities above. In the meantime, ICS-CERT has advised users of the Medfusion 4000 syringe pump to take steps to lessen the possibility of exploitation. One advice is to disconnect the pump from the internet altogether.
Smiths Medical and ICS-CERT provided more mitigation steps in this advisory.
