Many Healthcare, OT Systems Exposed to Attacks by NUCLEUS:13 Vulnerabilities

guest · Nov 11, 2021

Many Healthcare, OT Systems Exposed to Attacks by NUCLEUS:13 Vulnerabilities
November 9, 2021
https://www.securityweek.com/many-healthcare-ot-systems-exposed-attacks-nucleus13-vulnerabilities

Collectively referred to as NUCLEUS:13, the issues likely affect safety-critical devices, such as anesthesia machines, patient monitors and other types of devices used in healthcare. Other types of operational technology (OT) systems are also impacted.

The most important of the newly identified issues is CVE-2021-31886 (CVSS score of 9.8), a stack-based buffer overflow that exists because the FTP server fails to properly validate the length of the “USER” command. An attacker could exploit the vulnerability to cause a denial of service (DoS) condition or to achieve remote code execution.
Click to expand...

Two other similar issues in the FTP server (related to the improper validation of the length of the “PWD/XPWD” and “MKD/XMKD” commands) were assessed with a severity rating of high.

Of the remaining bugs, nine are considered high severity and could be exploited to leak sensitive information or cause DoS conditions. The last issue in the set is a medium-severity bug in the ICMP that could be exploited to send ICMP echo reply messages to arbitrary network systems.
Click to expand...

Developed by Accelerated Technology, Inc. (ATI) in 1993, Nucleus NET, the TCP/IP stack in the Nucleus real-time operating system (RTOS), is now owned by Siemens. Over its 28-year life, Nucleus has been deployed in devices across several verticals, including healthcare, automotive, and industrial systems.

The official Nucleus website claims the RTOS is deployed on over 3 billion devices, but Forescout believes that most of these are, in fact, components such as chipsets and baseband processors.
Click to expand...

Forescout: New Critical Vulnerabilities Found on Nucleus TCP/IP Stack

Log in or Sign up

Many Healthcare, OT Systems Exposed to Attacks by NUCLEUS:13 Vulnerabilities

guest Guest

Log in or Sign up

Many Healthcare, OT Systems Exposed to Attacks by NUCLEUS:13 Vulnerabilities

guest Guest

Useful Searches