Medical Devices Authentication Hardcoded Credential 弱身份验证

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
9.0	$0-$5k	0.00

摘要信息

发现了一个被归类为致命的漏洞，存在于Medical Devices。受影响的是未知函数，组件身份验证。对作为Hardcoded Credential的一部分的操作导致弱身份验证。此外，存在可用的漏洞利用。由于其背景和接受程度，该漏洞具有历史性影响。

发现了一个被归类为致命的漏洞，存在于Medical Devices。受影响的是未知函数，组件身份验证。对作为Hardcoded Credential的一部分的操作导致弱身份验证。利用 CWE 标识该问题会跳转到 CWE-287。此漏洞的脆弱性 2013-06-13由公示人Billy Rios and Terry McCorkle、公示人所属公司Cylance Inc.、公示人身份ICS-ALERT-13-164-01 - Medical Devices Hard-Coded Passwords、公示人类型为公告 (网站)所披露。您可以在 ics-cert.us-cert.gov 下载该通告。此次披露发布已与供应商协调。披露内容包括：

Because of the critical and unique status that medical devices occupy, ICS-CERT has been working in close cooperation with the Food and Drug Administration (FDA) in addressing these issues. ICS-CERT and the FDA have notified the affected vendors of the report and have asked the vendors to confirm the vulnerability and identify specific mitigations. ICS-CERT is issuing this alert to provide early notice of the report and identify baseline mitigations for reducing risks to these and other cybersecurity attacks. ICS-CERT and the FDA will follow up with specific advisories and information as appropriate.

没有可用的技术细节。该漏洞的流行度高于平均水平。此外，存在可用的漏洞利用。当前，大致为 USD $0-$5k。由于其背景和接受程度，该漏洞具有历史性影响。公告指出：

Researchers Billy Rios and Terry McCorkle of Cylance have reported a hard-coded password vulnerability affecting roughly 300 medical devices across approximately 40 vendors. According to their report, the vulnerability could be exploited to potentially change critical settings and/or modify device firmware.

如果存在长度，则其被声明为概念验证。估计零日攻击的地下价格约为$5k-$25k。

公告包含以下备注：

Take steps to limit unauthorized device access to trusted users only, particularly for those devices that are life-sustaining or could be directly connected to hospital networks. Appropriate security controls may include: user authentication, for example, user ID and password, smartcard or biometric; strengthening password protection by avoiding hard?coded passwords and limiting public access to passwords used for technical device access; physical locks; card readers; and guards. Protect individual components from exploitation and develop strategies for active security protection appropriate for the device’s use environment. Such strategies should include timely deployment of routine, validated security patches and methods to restrict software or firmware updates to authenticated code. Note: The FDA typically does not need to review or approve medical device software changes made solely to strengthen cybersecurity. Use design approaches that maintain a device’s critical functionality, even when security has been compromised, known as "fail-safe modes." Provide methods for retention and recovery after an incident where security has been compromised. Cybersecurity incidents are increasingly likely and manufacturers should consider incident response plans that address the possibility of degraded operation and efficient restoration and recovery.