BD Identifies High Severity Vulnerability in its Diagnostic Solutions Products
Becton, Dickinson, and Company (BD) has discovered a high-severity vulnerability affecting several of its BD Diagnostic Solutions Products. The vulnerability, tracked as CVE-2024-10476 (CVSS v3, 8.0), is due to the use of default credentials, which were intended for use only by BD technical support teams within the clinical setting. Exploitation of the vulnerability could potentially allow a threat actor to access, modify, or delete data, including personally identifiable information (PII) and protected health information (PHI). The vulnerability could be exploited in a low-complexity attack, which could cause a system shutdown or impact the availability of the system.
The vulnerability affects all versions of the following products:
- BD BACTEC Blood Culture System
- BD COR System
- BD EpiCenter Microbiology Data Management System
- BD MAX System
- BD Phoenix M50 Automated Microbiology System
- BD Synapsys Informatics Solution
Exploitation of the vulnerability would require a threat actor to have direct access (logical or physical) to the affected product, so a threat actor would need to compromise the local network in order to exploit the flaw. In some cases, a threat actor would also need to be physically present at the instrument to use the service credentials, which greatly limits the potential for exploitation.
To strengthen security, BD recommends limiting access to the products to authorized personnel, ensuring passwords are tightly controlled, logging and monitoring network traffic attempting to reach medical device management environments, disabling RDP ports, establishing appropriate permissions on file shares, and disconnecting devices from the network if connectivity is not required. BD said it is unaware of any attempted exploitation of the flaw and is proactively contacting all customers to provide technical assistance to update the default credentials.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
