75% of medical infusion pumps affected by known vulnerabilities

Researchers analyzed more than 200,000 network-connected medical infusion pumps and discovered that over 100,000 of them are vulnerable.

Researchers from Palo Alto Networks have analyzed more than 200,000 medical infusion pumps on the networks of hospitals and other healthcare organizations and discovered that 75% are affected by known vulnerabilities that could be exploited by attackers.

“We reviewed crowdsourced data from scans of more than 200,000 infusion pumps on the networks of hospitals and other healthcare organizations using IoT Security for Healthcare from Palo Alto Networks.” reads the report published by Palo Alto Networks. “An alarming 75 percent of infusion pumps scanned had known security gaps that put them at heightened risk of being compromised by attackers. These shortcomings included exposure to one or more of some 40 known cybersecurity vulnerabilities and/or alerts that they had one or more of some 70 other types of known security shortcomings for IoT devices.”

One of the most interesting findings that emerged from the report is that 52% of all infusion pumps analyzed by the experts were susceptible to two vulnerabilities publicly disclosed in 2019. These data are disconcerting considering that the average infusion pump has a life of eight to 10 years.

The following table reports the 10 most prevalent issues that emerged from the scan of network-connected medical devices. 

CVE	Severity (Score)	% of analyzed pumps with CVEs
1	CVE-2019-12255	9.8 (Critical)	52.11%
2	CVE-2019-12264	7.1 (High)	52.11%
3	CVE-2016-9355	5.3 (Medium)	50.39%
4	CVE-2016-8375	4.9 (Medium)	50.39%
5	CVE-2020-25165	7.5 (High)	39.54%
6	CVE-2020-12040	9.8 (Critical)	17.83%
7	CVE-2020-12047	9.8 (Critical)	15.23%
8	CVE-2020-12045	9.8 (Critical)	15.23%
9	CVE-2020-12043	9.8 (Critical)	15.23%
10	CVE-2020-12041	9.8 (Critical)	15.23%

^{Table 1. The top 10 most prevalent vulnerabilities found in the more than 200,000 inf}

Experts grouped the issues is several categories, including leakage of sensitive information, unauthorized access and buffer overflow. Palo Alto Networks reported that some issues are related to third-party cross-platform libraries used by the devices, such as network stacks. CVE-2019-12255 and CVE 2019-12264 vulnerabilities in the TCP/IP stack IPNet.

Both flaws affect 52% of the analyzed infusion pumps, approximately more than 104,000 devices.

Palo Alto Networks recommends healthcare providers adopt a proactive security strategy to prevent attacks, below are some key capabilities to consider when evaluating IoMT security strategies and technologies for healthcare:

• Accurate discovery and inventory
• Holistic risk assessment
• Apply risk reduction policies
• Prevent Threats

“Among the 200,000 infusion pumps we studied, 75% were vulnerable to at least one vulnerability or threw up at least one security alert. While some of these vulnerabilities and alerts may be impractical for attackers to take advantage of unless physically present in an organization, all represent a potential risk to the general security of healthcare organizations and the safety of patients – particularly in situations in which threat actors may be motivated to put extra resources into attacking a target.” concludes the report.

With attack surfaces widening and attack vectors becoming more refined than ever before, now’s the time for healthcare organizations to define medical device security with a new level of sophistication. “

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking,IoT)

[adrotate banner=”5″]

[adrotate banner=”13″]