Subsequent changes to the enterprise network could introduce new risks and require new analysis. Users should also identify, analyze, evaluate, and control all risks associated with integration of medical devices in an enterprise network.

Firewall each network segment, limiting inbound and outbound connections.

In case of remote connection (WAN), keep the subnetwork dedicated by using a VPN network connection.Ensure Phoenix machines and Exalis Server PCs reside on a dedicated subnetwork (the machines and the Exalis servers must be the ONLY devices present within it). Ensure proper network segmentation as outlined in the operating manual.Ensure medical device implementations and configurations employ cybersecurity defense-in-depth strategies such as:.

MITIGATIONSīaxter recommends users apply the following implementation guidance:

COMPANY HEADQUARTERS LOCATION: United Statesīaxter reported this vulnerability to CISA.

CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health.

A CVSS v3 base score of 7.5 has been calculated the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). An attacker with access to the network could observe sensitive treatment and prescription data sent between the Phoenix system and the Exalis tool.ĬVE-2020-12048 has been assigned to this vulnerability. The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool.

Phoenix Hemodialysis Delivery System SW 3.36 and 3.40Ĥ.2 VULNERABILITY OVERVIEW 4.2.1 CLEARTEXT TRANSMISSION OF SENSITIVE DATA CWE-319.

The following versions of the Phoenix Hemodialysis Delivery System are affected: Successful exploitation of this vulnerability could allow an attacker with unauthorized network access to view sensitive data. This updated advisory is a follow-up to the original advisory titled ICSA-20-170-03 Baxter Phoenix Hemodialysis Delivery System that was published June 18, 2020, on the ICS webpage on.

Vulnerability: Cleartext Transmission of Sensitive Information.

Equipment: Phoenix Hemodialysis Delivery System.

ATTENTION: Exploitable remotely/low skill level to exploit.

Phoenix dialysis machine manual