Description Preview
A critical buffer overflow vulnerability (CVE-2021-37161) affects the HMI3 Control Panel within Swisslog Healthcare's Nexus Panel running software versions prior to 7.2.5.7. The vulnerability allows attackers to overwrite an internal queue data structure, potentially leading to remote code execution. This issue is part of the "PwnedPiper" vulnerabilities discovered by Armis security researchers in pneumatic tube systems commonly used in hospitals for transporting medications, lab samples, and other critical materials.
Overview
The vulnerability exists in the UDP packet handling functionality of the Nexus Panel's HMI3 Control Panel. When processing certain UDP packets, the software fails to properly validate input size, resulting in a buffer overflow condition. An attacker with network access to the affected system can exploit this vulnerability to overwrite memory, corrupt data structures, and potentially execute arbitrary code with the privileges of the running application. This could lead to complete system compromise, allowing attackers to disrupt hospital operations, manipulate data, or use the system as an entry point for broader network attacks. The vulnerability is particularly concerning as these systems are widely deployed in healthcare facilities and play a critical role in hospital operations.
Remediation
- Update to Nexus Software version 7.2.5.7 or later, which contains fixes for this vulnerability.
- If immediate patching is not possible, implement network segmentation to restrict access to the Nexus Panel systems from untrusted networks.
- Monitor network traffic to and from the Nexus Panel systems for suspicious activity.
- Implement proper access controls and authentication mechanisms for all network-connected devices.
- Contact Swisslog Healthcare technical support for assistance with applying the necessary updates.
- Conduct a security assessment of your pneumatic tube system infrastructure to identify any additional vulnerabilities or misconfigurations.
- Follow the specific guidance provided in Swisslog Healthcare's security bulletin for this vulnerability.
References
- Armis PwnedPiper Research: https://www.armis.com/PwnedPiper
- Swisslog Healthcare Product Information: https://www.swisslog-healthcare.com
- Vendor Security Advisory: https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37161-bulletin---underflow-in-udprxthread.pdf
- Swisslog Healthcare CVE Disclosures: https://www.swisslog-healthcare.com/en-us/customer-care/security-information/cve-disclosures
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Health Care & Social AssistanceHealth Care & Social Assistance: Low
- Educational ServicesEducational Services: Low
- Accommodation & Food ServicesAccommodation & Food Services: Low
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services: Low
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting: Low
- Arts, Entertainment & RecreationArts, Entertainment & Recreation: Low
- ConstructionConstruction: Low
- Finance and InsuranceFinance and Insurance: Low
- InformationInformation: Low
- Management of Companies & EnterprisesManagement of Companies & Enterprises: Low
- ManufacturingManufacturing: Low
- MiningMining: Low
- Other Services (except Public Administration)Other Services (except Public Administration): Low
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services: Low
- Public AdministrationPublic Administration: Low
- Real Estate Rental & LeasingReal Estate Rental & Leasing: Low
- Retail TradeRetail Trade: Low
- Transportation & WarehousingTransportation & Warehousing: Low
- UtilitiesUtilities: Low
- Wholesale TradeWholesale Trade: Low
