UDTSecure Threat Advisory - ID: 1038001 - Vyaire Medical CareFusion Upgrade Utility Vulnerability

UDTSecure Threat Advisory – ID: 1038001 – Vyaire Medical CareFusion Upgrade Utility Vulnerability

CVE Reference: CVE-2018-5457
Date: February 7^th, 2018
Status: Confirmed
Fix Available: Yes
Impact: A software vulnerability in Vyaire Medical’s CareFusion Upgrade Utility may allow an attacker to insert a malicious DLL on the target system and run arbitrary code.
Security Rating: HIGH

Overview
An uncontrolled search path element issue was discovered in Vyaire Medical’s CareFusion Upgrade Utility application used with Windows XP systems. A successful exploit of this vulnerability requires the local user to install a crafted DLL on the target machine. The application loads the DLL and gives the attacker access at the same privilege level as the application. Vyaire Medical has produced an update that mitigates this vulnerability.

Affected Software:
The following versions of CareFusion Upgrade Utility, designed to upgrade compatible units to the latest software versions, are affected:

CareFusion Upgrade Utility used with Windows XP systems, Versions 2.0.2.2 and prior versions.

Recommendation:
Vyaire Medical is no longer supporting the CareFusion Upgrade Utility v2.0.2.2 and recommends that users upgrade to the newer Vyaire Upgrade Utility v2.0.3.0. This updated Upgrade Utility will not install on Windows XP and will require updating the underlying system to Windows 7 or later.

Vyaire Medical has released a Product Security Bulletin, available at the following URL: https://www.vyaire.com/productsecurity

The Vyaire Upgrade Utility v2.0.3.0 update is available at the following URL:

https://www.vyaire.com/us/our-products/respiratory-care/pulmonary-function-testing/spirometers/spirometry-software-and-firmware-downloads

In addition, the following defensive measures should be enacted to minimize the risk of exploitation of this vulnerability:

Do not upload and run untrusted files without verifying the integrity of the file.
Interact with, and only obtain files, software, and software patches from trustworthy highly reputable sources.
Ensure that employees with access to the CareFusion Upgrade Utility are fully aware of the ongoing potential for social engineering attacks and are trained to identify and avoid social engineering attacks.
Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.

Underlying Affected Products:
The affected product, CareFusion Upgrade Utility, is designed to upgrade compatible units to the latest software versions. According to Vyaire Medical, CareFusion Upgrade Utility is deployed across the Healthcare and Public Health sector. Vyaire Medical estimates these products are used primarily in the United States and Europe, with a small percentage in Asia.

CareFusion Upgrade Utility used with Windows XP systems, Versions 2.0.2.2 and prior, is affected by this vulnerability.

Accomplish More With UDT

Get your custom solution in cybersecurity, lifecycle management, digital transformation and managed IT services. Connect with our team today.

More to explore

The Cloud Advantage: 4 Ways Cloud Solutions Are Transforming Organizations (with Case Studies)

By embracing cloud solutions, businesses can harness a level of flexibility, innovation, and collaboration that propels them forward, providing a decisive edge over competitors. This is called the “Cloud Advantage.”

Reliable Data Centers Have These 3 Things In Common (with Strategies for Optimizing Efficiency)

Data centers ensure that businesses have robust data storage and management capabilities to access, organize, and safeguard their wealth of information. Discover the key qualities that make your data center reliable.

The Benefits and Risks of Using AI at Your Business—How To Leverage AI Responsibly

AI is an alluring tool for business, but it comes with risks. Explore the pros and cons of using AI, including how to mitigate the potential vulnerabilities associated with this technology.

Ransomware Attacks on K12 Education are Spiking (Again)—Here’s How To Keep Your School District Safe

When it comes to cybersecurity, the last few years have been rough for Education. Hear expert insights on the top ransomware attacks facing K12 and Higher Ed—and how to avoid being the next victim.

October is Cybersecurity Awareness Month—Here Are 4 Actionable Strategies to Boost Your Data Security Right Now

To help organizations stay ahead of evolving risks, sophisticated attack vectors, and the latest data security threats, UDT’s Mike Sanchez, CISO & SVP of Cybersecurity Solutions, has compiled the following risk management best practices for improving your organization’s security posture.

How To Select Your E-Rate Service Provider—An 8-Step Roadmap

To help you make an informed choice, we’ve developed a clear, 8-step roadmap to assist you in selecting the ideal E-Rate service provider for your unique situation.