Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Hardcoded Credentials Found in Medical System

Carnegie Mellon University’s CERT has issued a security advisory on the MEDHOST Perioperative Information Management System (PIMS), a system designed to streamline the progress from patient introduction to surgery. It’s not a vulnerability we should expect these days – especially for a medical system – but PIMS contains hardcoded credentials. These credentials provide access to the customer database.

Carnegie Mellon University’s CERT has issued a security advisory on the MEDHOST Perioperative Information Management System (PIMS), a system designed to streamline the progress from patient introduction to surgery. It’s not a vulnerability we should expect these days – especially for a medical system – but PIMS contains hardcoded credentials. These credentials provide access to the customer database.

“An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the application database server may be able to obtain or modify patient information,” warns the CERT advisory

“With the surgery department so critical to a hospital’s financial well-being and patient safety initiatives, there’s no room for inefficiencies or costly mistakes,” says the MEDHOST website. …this comprehensive suite of applications fits within existing perioperative workflows, reducing scheduling delays and improving overall patient care.”

MEDHOST has not published any information about this vulnerability. PIMS itself contains several different modules. It isn’t clear from the advisory whether access to the customer database could also provide access to the different modules, such as PIMS Surgery. Nevertheless, the ability to obtain or alter patient data is a serious issue.

MEDHOST has addressed the problem in version PIMS 2015R1 and newer. Administrators are advised to upgrade to the latest version. This is particularly important now that the vulnerability has been made public – malicious actors could reverse earlier versions to obtain the credentials.

The danger with hardcoded credentials is that they can be used to bypass what might otherwise be very strong authentication procedures developed and trusted by the administrators. Since the product can be hosted and accessed remotely, administrators should ensure that only trusted sources can access the server hosting the product. This should be standard procedure whether using a vulnerable version or a newer fixed version.

The credentials do not seem to have been leaked, and it doesn’t appear as if they have been used for malicious purposes. The vulnerability was discovered and reported by Daniel Dunstedter.

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.

Register

Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Vulnerabilities

Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Vulnerabilities

GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet