CVE-2021-37163:

Default Credentials for Telnet Server in Swisslog Healthcare Nexus HMI3 Control Panel

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Aug 2, 2021
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.6
EPSS Percentile:69%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Default Credentials for Telnet Server in Swisslog Healthcare Nexus HMI3 Control Panel

Overview

This vulnerability (CVE-2021-37163) is part of the "PwnedPiper" set of vulnerabilities discovered in Swisslog Healthcare's pneumatic tube system (PTS). The HMI3 Control Panel contains two user accounts with hardcoded credentials that can be used to access the system via Telnet. These default credentials cannot be changed by administrators, creating a persistent security risk. An attacker with network access to the device could use these credentials to gain unauthorized access to the system, potentially allowing them to execute arbitrary commands with the privileges of these accounts. This vulnerability could lead to system compromise, data theft, or disruption of critical hospital operations that rely on the pneumatic tube system for transporting medications, lab samples, and other essential items.

Remediation

1. Update to Nexus Software version 7.2.5.7 or later, which addresses this vulnerability.
2. If immediate patching is not possible, implement network segmentation to restrict access to the HMI3 Control Panel.
3. Use firewall rules to block unauthorized Telnet access (port 23) to the affected devices.
4. Monitor network traffic to detect potential exploitation attempts.
5. Contact Swisslog Healthcare technical support for assistance with secure configuration and additional mitigation strategies.
6. Conduct regular security assessments of your healthcare network infrastructure to identify similar vulnerabilities.