Critical Vulnerabilities Identified in Baxter Welch Allyn Products
Two critical vulnerabilities have been identified in Baxter Welch Allyn products – The Welch Allyn Product Configuration Tool and Welch Allyn Connex Spot Monitor.
Baxter identified a critical flaw that affects versions 1.9.4.1 and prior versions of the Welch Allyn Product Configuration Tool. The flaw – tracked as CVE-2024-5176 – is due to insufficiently protected credentials and has been assigned a CVSS v3.1 base score of 9.6 and a CVSS v4 score of 9.4. According to Baxter, “any credentials that were used for authentication or input while using the Welch Allyn Configuration Tool have the potential to be compromised and should be changed immediately.”
Baxter has not found any evidence to suggest that the flaw has been exploited in the wild and plans to release a new software update to address the flaw. When the update is released, it will fix the flaw and no action will be required; however, the updated version – 1.9.4.2 – is not due to be released until Q3, 2024. In the meantime, the Welch Allyn Configuration Tool has been removed from public access. If customers need to create configuration files, they should contain Baxter Technical Support.
The second critical flaw affects version 1.52 and prior versions of the Welch Allyn Connex Spot Monitor (CSM) and is due to the use of a default cryptographic key for potentially critical functionality. If exploited, an attacker could modify the device configuration and firmware data, which would impact and/or delay patient care. The vulnerability is tracked as CVE-2024-1275 and has been assigned a CVSS v3.1 base score of 7.4 and a CVSS v4 score of 9.1. The vulnerability was reported to Baxter by Brikl CEO & Co-Founder, Maarten Boone, and Zerocopter CTO, Edwin Van Andel.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Baxter has released a software update to address the vulnerability on all devices and software. The vulnerability is fixed in Welch Allyn Connex Spot Monitor version 1.5.2.01, which was released on October 16, 2023. If it is not possible to apply the update, Baxter has suggested a workaround to reduce risk, which involves applying proper network and physical security controls and ensuring that a unique encryption key is configured and applied to the product, as recommended in the product manual.
