Is Your BD Alaris System Impacted?
Cybersecurity & Infrastructure Security Agency released an advisory of high-risk vulnerabilities for the BD Alaris System with Guardrails Suite MX on July 18, 2023. The advisory affects all Point-of-Care Units (PCU, or commonly called “brain”) with version 12.1.3, which is at the time of this writing, all of them. Other vulnerabilities also impact the Guardrails Editor, Systems Manager, CQI Report, and Calculation Services.
If you are using the pumps, then you are impacted.
What Can You Do Against High-Risk Vulnerabilities?
In total, there are 8 vulnerabilities. One vulnerability was patched out if you have PCUs with 12.1.3 running. In sum, the vulnerabilities mean that a bad actor can influence your pumps in many ways, from taking them offline, stealing data, modifying data, and any type of physical actions that may be accomplished by modifying that data. For many of the vulnerabilities, physical access is required. For others, network access is required.
Therefore, it’s best to make sure that only the people who have physical access to the pumps do have physical access. It’s also important to ensure that only genuine Alaris parts are attached to the PCUs. Another good strategy is to segment your pumps from other devices while they’re on your network and properly setup your network for secure communication.
Setting up proper security and encryption for your System Manager is also an important step.
Are People Actively Exploiting the BD Alaris System?
Short answer is no. At this time, nobody is targeting the Alaris pumps. This often gives you time to respond to the CISA alerts, but if an exploit is found in the wild, you will be protected if you take appropriate actions to safeguard your pumps.
Need Help?
CE-Tech is ready to help you if you need to protect your pumps from the high-risk vulnerabilities for the BD Alaris System? We can also look at your inventory to find other systems that may be impacted by the many dozens of other CISA alerts.