Smiths-Medical Medfusion 4000 Wireless Syringe Infusion Pump 1.1/1.5/1.6 Communication out-of-bounds

Summaryinfo

A vulnerability has been found in Smiths-Medical Medfusion 4000 Wireless Syringe Infusion Pump 1.1/1.5/1.6 and classified as critical. This vulnerability affects unknown code of the component Communication Module. This manipulation causes out-of-bounds. This vulnerability is tracked as CVE-2017-12722. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical was found in Smiths-Medical Medfusion 4000 Wireless Syringe Infusion Pump 1.1/1.5/1.6 (Medical Device Software). Affected by this vulnerability is an unknown part of the component Communication Module. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump reads memory out of bounds, causing the communications module to crash. Smiths Medical assesses that the crash of the communications module would not impact the operation of the therapeutic module.

The bug was discovered 09/07/2017. The weakness was disclosed 02/15/2018 by Scott Gayou (Website). It is possible to read the advisory at securityfocus.com. This vulnerability is known as CVE-2017-12722 since 08/09/2017. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 161 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 100665†). The entries VDB-113344, VDB-113345, VDB-113346 and VDB-113348 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Medical Device Software

Vendor

• Smiths-Medical

Name

• Medfusion 4000 Wireless Syringe Infusion Pump

Version

• 1.1
• 1.5
• 1.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion