Baxter Connex Health Portal Vulnerabilities: Critical SQL Injection and Access Control Flaws

Executive Summary of Vulnerabilities​

The vulnerabilities reported are particularly concerning due to the following classifications:

• CVSS v3.1 Score: 10.0 - This outstanding value indicates a critical security flaw with a high potential for exploitation.
• Attack Vector: The vulnerabilities can be exploited remotely with a low level of attack complexity.
• Affected Vendor: Baxter International Inc.
• Equipment at Risk: The Connex Health Portal is the targeted equipment. Notably, the two vulnerabilities detailed are:
  1. SQL Injection
  2. Improper Access Control

     Risk Evaluation​

     Successful exploitation of these vulnerabilities can lead to significant negative outcomes, including:
  []Malicious code injection []Unauthorized shutdown of database services
• Manipulation or deletion of sensitive data This poses a serious risk not only to data integrity but also to the trustworthiness of healthcare services that depend on the Connex Health Portal for managing patient data.

  Technical Details of the Vulnerabilities​

  Affected Products​

  All versions of the Baxter Connex Health Portal prior to August 30, 2024, are acknowledged as vulnerable. Baxter is known for its strong ties in the medical technology and healthcare sectors, making the swift protection of such platforms crucial.

  Vulnerability Overview​

  1. SQL Injection:
     • Identified as CWE-89, this vulnerability allows attackers to inject arbitrary SQL queries through unsanitized parameters, enabling them to execute commands on the database, manipulating sensitive patient information or shutting down the database entirely. The assigned CVE is CVE-2024-6795, with a CVSS score of 10.0.

1. Improper Access Control:
   • Labeled as CWE-284, this flaw could let unauthorized individuals access critical clinical information and alter or delete clinic-specific data. The assigned CVE is CVE-2024-6796, with a CVSS score of 8.2.

     Background Context​

     The vulnerabilities predominantly affect the healthcare sector, which is already facing high cybersecurity risks. Critical infrastructure such as healthcare relies on secure systems due to the sensitive nature of its data. Furthermore, all versions of the Connex Health Portal released before the stipulated patch date are exposed to these threats, especially as the United States is the principal deployment area for these devices.

     Mitigation Measures​

     Baxter has acted promptly by issuing patches that address these vulnerabilities. As of now, no user action is required while operating the updated systems. Further, CISA has counseled organizations to employ multiple defensive measures, such as:
   • Limiting network exposure to control system devices.
   • Isolating control system networks and remote devices from business networks.
   • Utilizing secure remote access methods, like Virtual Private Networks (VPNs). Additionally, organizations are urged to conduct thorough impact analyses and risk assessments to implement appropriate defensive strategies.

     Guidance for Users​

     Organizations are encouraged to adopt cybersecurity best practices, especially against social engineering attacks. Recommendations include:
   • Avoiding interaction with unsolicited emails or attachments.
   • Following cybersecurity advisories available on CISA's website.

     Conclusion and Recap​

     The vulnerabilities identified in the Baxter Connex Health Portal create a significant risk landscape for healthcare data management. Given the critical nature of the data and the potential repercussions, it is imperative that users remain vigilant and proactive to implement the mitigating strategies recommended by Baxter and CISA. Overall, this advisory not only emphasizes the need for secure medical technology systems but also reinforces the ongoing challenges faced in safeguarding healthcare data from cyber threats. As the industry moves forward, continuous updates and adherence to security protocols will remain indispensable to protecting both patient information and the integrity of healthcare systems.

     Update History​

   • September 05, 2024: Initial publication of vulnerabilities and recommended actions. Adhering to the practices and recommendations detailed can help ensure a robust defense against potential threats targeting these critical healthcare functions. Organizations must stay informed about updates and promptly apply all available security patches to protect sensitive data effectively. Source: CISA Baxter Connex Health Portal