CVE-2024-10476: BD Diagnostic Solutions Auth Bypass Flaw

CVE-2024-10476 Overview

CVE-2024-10476 is a hardcoded credentials vulnerability affecting BD Diagnostic Solutions products. Default credentials are used in the affected systems, which if exploited, could allow threat actors to access, modify, or delete sensitive data including protected health information (PHI) and personally identifiable information (PII). Additionally, exploitation may enable attackers to shut down or otherwise impact system availability.

Critical Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive healthcare data (PHI/PII), data modification or deletion, and potential system shutdown affecting diagnostic operations in healthcare environments.

Affected Products

• BD Diagnostic Solutions products with default credentials
• BD Synapsys™ Informatics Solution (when installed on NUC server only)
• Note: BD Synapsys™ Informatics Solution installed on customer-provided virtual machines or BD Kiestra™ SCU hardware is not affected

Discovery Timeline

• 2024-12-17 - CVE CVE-2024-10476 published to NVD
• 2024-12-17 - Last updated in NVD database

Technical Details for CVE-2024-10476

Vulnerability Analysis

This vulnerability stems from the use of default credentials (CWE-1392: Use of Default Credentials) in BD Diagnostic Solutions products. The issue requires adjacent network access, meaning an attacker must be on the same network segment as the vulnerable device to exploit it. While some level of authentication is required, the attack complexity is low once network access is achieved.

The vulnerability presents significant risks in healthcare environments where these diagnostic systems handle sensitive patient information. Successful exploitation could compromise the confidentiality, integrity, and availability of diagnostic data and system operations.

It is important to note that the scope of this vulnerability is limited to specific deployment configurations. BD Synapsys™ Informatics Solution is only vulnerable when installed on a NUC server. Installations on customer-provided virtual machines or on the BD Kiestra™ SCU hardware are not affected by this vulnerability.

Root Cause

The root cause of CVE-2024-10476 is the use of default credentials in BD Diagnostic Solutions products. Default credentials are a common security weakness where products are shipped with pre-configured authentication credentials that are identical across all installations. When these credentials are not changed during deployment or are documented publicly, attackers can use them to gain unauthorized access to systems.

Attack Vector

The attack vector for this vulnerability is adjacent network (AV:A), meaning the attacker must have access to the local network segment where the vulnerable BD Diagnostic Solutions product is deployed. This could be achieved through physical access to the healthcare facility's network, compromise of another device on the same network, or through wireless network access if applicable.

Once on the adjacent network, an attacker with knowledge of the default credentials could authenticate to the system and potentially:

• Access sensitive patient data including PHI and PII
• Modify or delete diagnostic data and system configurations
• Disrupt system availability by shutting down services or the entire system

The attack requires low privileges and no user interaction, making it relatively straightforward to execute once network access is obtained.

Detection Methods for CVE-2024-10476

Indicators of Compromise

• Unexpected authentication attempts using default or common usernames on BD Diagnostic Solutions products
• Unusual access patterns or login times from adjacent network segments
• Unauthorized data access, modification, or deletion in diagnostic systems
• Unexpected system shutdowns or service disruptions

Detection Strategies

• Monitor authentication logs for successful logins using default account names
• Implement network segmentation monitoring to detect lateral movement attempts toward diagnostic systems
• Deploy intrusion detection systems (IDS) with rules for detecting default credential usage attempts
• Audit user account activity and compare against authorized personnel access patterns

Monitoring Recommendations

• Enable comprehensive logging on all BD Diagnostic Solutions products
• Implement Security Information and Event Management (SIEM) correlation rules for detecting default credential abuse
• Monitor network traffic to and from BD diagnostic systems for anomalous patterns
• Regularly review access logs and audit trails for unauthorized access attempts

How to Mitigate CVE-2024-10476

Immediate Actions Required

• Change all default credentials on affected BD Diagnostic Solutions products immediately
• Implement strong, unique passwords for all system accounts
• Restrict network access to diagnostic systems using network segmentation and firewall rules
• Review and audit all user accounts on affected systems to ensure only authorized personnel have access
• Verify deployment configuration to confirm whether your BD Synapsys™ installation is affected (NUC server installations only)

Patch Information

BD has released a cybersecurity vulnerability bulletin addressing this issue. Organizations should consult the BD Cybersecurity Vulnerability Bulletin for detailed remediation guidance and any available patches or updates.

Contact BD support for specific patch availability and installation instructions for your deployed products.

Workarounds

• Immediately change all default credentials to strong, unique passwords
• Implement network segmentation to isolate BD diagnostic systems from general network traffic
• Deploy additional access controls such as multi-factor authentication where supported
• Restrict physical and logical access to the network segments containing diagnostic equipment
• Consider migrating BD Synapsys™ Informatics Solution installations from NUC servers to customer-provided virtual machines or BD Kiestra™ SCU hardware, which are not affected by this vulnerability

# Example network segmentation configuration (conceptual)
# Isolate diagnostic systems on dedicated VLAN
# Configure firewall rules to restrict access to authorized management stations only
# Enable logging for all authentication attempts
# Implement access control lists (ACLs) limiting traffic to essential services