1. EXECUTIVE SUMMARY As the world of medical technology continues to evolve, so do its vulnerabilities—particularly those tied to cybersecurity. A recent advisory from the Cybersecurity and Infrastructure Security Agency (CISA) has shed light on critical vulnerabilities discovered in products from BPL Medical Technologies, specifically the PWS-01-BT Personal Weighing Scale and the Be Well Android Application. The reports are alarming, especially considering the low attack complexity and readily accessible public exploits related to the vulnerabilities.
The following products from BPL Medical Technologies are affected by this vulnerability:
- CVSS v4 Score: 5.1
- Vendor: BPL Medical Technologies
- Equipment: PWS-01-BT, Be Well Android App
- Vulnerability: Cleartext Transmission of Sensitive Information This advisory serves as both a warning and guidance for users of these medical technologies, exposing the risks associated with unencrypted data transmission. 2. RISK EVALUATION In the realm of health technology, the integrity and confidentiality of sensitive data cannot be overstated. Successful exploitation of the outlined vulnerabilities could allow malicious actors to intercept and modify crucial data as it traverses networks. This not only raises concerns about data privacy but also about potential health impacts if false information was fed back into systems that support patient care. The ramifications of such security flaws aren't just theoretical; they could directly impact patient safety, particularly in devices routinely used in healthcare settings. 3. TECHNICAL DETAILS
3.1 Affected Products
The following products from BPL Medical Technologies are affected by this vulnerability:- Be Well Android Application: Versions 3.64 and earlier
- PWS-01-BT: All versions
3.2 Vulnerability Overview
3.2.1 Cleartext Transmission of Sensitive Information (CWE-319)
At the crux of these vulnerabilities lies the cleartext transmission of sensitive information. Specifically, the PWS-01-BT devices transmit sensitive data in unencrypted Bluetooth Low Energy (BLE) packets. Notably, this data lacks both authentication and integrity protection, making it particularly vulnerable to interception. The unique identifier CVE-2024-34463 has been assigned to this vulnerability, receiving a CVSS v3.1 base score of 4.6. In parallel, a CVSS v4 score of 5.1 has been calculated, revealing how critical this flaw is for understanding its potential impact.3.3 Background
- Critical Infrastructure Sectors: Healthcare and Public Health Sector
- Countries/Areas Deployed: Worldwide
- Company Headquarters Location: India The global deployment of these technologies only heightens the urgency of addressing this vulnerability. Healthcare systems are often prime targets for cyberattacks due to the sensitive nature of their data.
3.4 Researcher
The vulnerability was reported by Yash Chandna and Hanit Thakur, emphasizing the role security researchers play in safeguarding public health technologies. 4. MITIGATIONS While BPL Medical Technologies has not engaged with CISA regarding potential mitigations, users of these affected products are encouraged to contact the vendor for additional information. CISA recommends a variety of defensive measures including:- Minimizing Network Exposure: Make sure that all systems are not accessible from the internet.
- Firewall Usage: Isolate control systems behind firewalls from other networks.
- Secure Remote Access: Utilize Virtual Private Networks (VPNs) for remote access, acknowledging that even VPNs can harbor vulnerabilities. These measures are crucial, especially in maintaining a secure environment around critical health technologies. 5. UPDATE HISTORY The advisory was initially published on September 10, 2024, marking the beginning of wider awareness and hopefully, prompt action.
