Critical RCE Vulnerability Identified in Medtronic Paceart Optima System
A critical vulnerability has been identified in the Medtronic Paceart Optima System, which is used to compile and manage patients’ cardiac data. The vulnerability is tracked as CVE-2023-31222 and is due to the deserialization of untrusted data. The vulnerability has been assigned a CVSS v3 base score of 9.8 out of 10.
The vulnerability affects all versions of Paceart Optima up to and including version 1.11 and can be exploited remotely by an unauthorized user by sending specially crafted messages to the Paceart Optima system. Successful exploitation of the flaw would allow an attacker to remotely execute arbitrary code and gain a foothold for network penetration. The flaw could also be exploited to trigger a denial-of-service condition resulting in the Paceart Optima system becoming slow and unresponsive, preventing healthcare delivery organizations from using the system.
The flaw can only be exploited if the Paceart Messaging Service is enabled in the Paceart Optima system, which is an optional service. An immediate mitigation to prevent the flaw from being exploited is to disable that service on the Application Server. Medtronic has provided instructions for manually disabling the Paceart Messaging Service on the Application Server and disabling message queuing on the Application Server, which will fully mitigate the vulnerability. Medtronic should be contacted for mitigation advice if a healthcare delivery organization is running a combined Application Server and Integration Server.
Medtronic has fixed the vulnerability in v1.12, and healthcare organizations should contact Medtronic to schedule the update; however, the recommended mitigation steps should be followed to prevent exploitation until the update is installed. Medtronic said the vulnerability was discovered during routine monitoring and there have been no detected instances of the vulnerability being exploited.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
CISA recommends additional defensive measures to improve security and reduce the risk of exploitation of vulnerabilities. These include minimizing network exposure and ensuring control systems are not accessible from the Internet, locating control system networks and devices behind firewalls, and only using secure methods for remote access, such as VPNs.
