CVE-2016-8355 in CADD-Solis Medication Safety Software
Summary
by MITRE
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants an authenticated user elevated privileges on the SQL database, which would allow an authenticated user to modify drug libraries, add and delete users, and change user permissions. According to Smiths-Medical, physical access to the pump is required to install drug library updates.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/14/2017
The vulnerability identified as CVE-2016-8355 represents a critical privilege escalation flaw within Smiths-Medical CADD-Solis Medication Safety Software across multiple versions including 1.0, 2.0, 3.0, and 3.1. This software operates within healthcare environments where medication safety is paramount, making such vulnerabilities particularly concerning from a cybersecurity perspective. The issue stems from insufficient access controls within the SQL database layer, allowing authenticated users to gain elevated privileges that should normally be restricted to administrative personnel. This misconfiguration creates a pathway for unauthorized modification of critical medication data that directly impacts patient safety and healthcare delivery systems.
The technical flaw manifests as a privilege escalation vulnerability where legitimate users can exploit the software's authentication mechanisms to gain administrative-level access to the underlying database. This vulnerability falls under the CWE-264 category of Permissions, Privileges, and Access Controls, specifically addressing inadequate privilege management within database applications. The flaw enables authenticated users to perform operations that include modifying drug libraries, adding and deleting users, and changing user permissions, all of which represent serious security risks in medical environments where data integrity and access control are critical. The software's design appears to lack proper role-based access control implementation, allowing standard users to escalate their privileges through database-level manipulation.
From an operational impact perspective, this vulnerability creates significant risks for healthcare organizations using the CADD-Solis software. The ability to modify drug libraries means that malicious actors could potentially introduce incorrect dosing information, alter drug interactions, or manipulate medication protocols that could lead to serious patient harm or even death. The unauthorized addition and deletion of user accounts could disrupt legitimate access controls and create backdoors for future attacks. Changes to user permissions could allow attackers to elevate their own privileges or restrict access for legitimate healthcare workers, creating operational chaos and potential safety hazards. The fact that physical access to the pump is required to install drug library updates provides some operational limitation but does not eliminate the database-level privilege escalation threat.
The vulnerability's impact extends beyond immediate security concerns to encompass broader healthcare cybersecurity risks. According to industry standards and best practices, this represents a critical weakness in the software's security architecture that violates fundamental principles of least privilege and defense in depth. The ATT&CK framework would categorize this vulnerability under privilege escalation techniques, specifically targeting database access controls and credential manipulation. Healthcare organizations should implement immediate mitigations including network segmentation to isolate the affected systems, enhanced monitoring of database activities, and regular security assessments. The vendor should provide security patches and updates to address the privilege escalation flaw, while organizations should consider implementing additional authentication controls and access logging to detect unauthorized database modifications. This vulnerability underscores the importance of robust security testing for medical devices and software systems where patient safety is at stake, as the consequences of security breaches in healthcare environments can be catastrophic.