SB2019111108 - Multiple vulnerabilities in Medtronic Valleylab pruducts

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper Authentication (CVE-ID: CVE-2019-13531)

The vulnerability allows a local attacker to bypass authentication process.

The vulnerability exists due to an error in the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments. An attacker with physical access to the device can connect inauthentic instruments to the generator, bypass authentication process and gain unauthorized access to the application.

2) Protection Mechanism Failure (CVE-ID: CVE-2019-13535)

3) Use of hard-coded credentials (CVE-ID: CVE-2019-13543)

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials and read files on the target system.

4) Reversible One-Way Hash (CVE-ID: CVE-2019-13539)

Remediation

Install update from vendor's website.

References

• https://www.us-cert.gov/ics/advisories/icsma-19-311-01
• https://www.us-cert.gov/ics/advisories/icsma-19-311-02