A vulnerability has been discovered in Change Healthcare Cardiology, McKesson Cardiology, and Horizon Cardiology devices. The flaw could be target to take advantage by a locally authenticated user to insert files that could allow the attacker to run arbitrary code on an affected device.
The vulnerability – CVE-2019-18630 – was discovered by Alfonso Powers and Bradley Shubin of Asante Information Security who reported the vulnerability to Change Healthcare. Change Healthcare alerted the National Cybersecurity & Communications Integration Center (NCCIC) and a security advisory has now been released by US-CERT.
The vulnerability has been given a CVSS v3 base score of 7.8 out of 10 and is due to incorrect default permissions in the default installation. While the vulnerability only needs a low level of skill to exploit, a hacker would first need local system access which will restrict the potential for the flaw to be exploited.
Change Healthcare has published an advisory for users of these cardiology devices:
- Horizon Cardiology 11.x and earlier versions
- Horizon Cardiology 12.x
- McKesson Cardiology 13.x
- McKesson Cardiology 14. x
- Change Healthcare Cardiology 14.1.x
Change Healthcare has created a patch to address the vulnerability. All users of the above impacted products have been warned to get in touch with their Change Healthcare Support representative to schedule the patch being installed.
The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency advises the following mitigations to minimize the potential for the vulnerability to be exploited until such time as the patch can be put in place:
- Restrict network exposure for control system devices and/or systems.
- Place medical devices behind firewalls
- Keep medical devices as far apart as possible
- Create safeguards that limit access to medical devices to authorized personnel
- Use the principle of least privilege to access controls.
- Implement defense-in-depth strategies
- Turn off unnecessary accounts, protocols and services.
Before adding any mitigations, healthcare providers should complete an impact risk analysis and risk assessment.