"IoT: Security Researchers Warn of Vulnerabilities in Hospital Pneumatic Tube Systems"

Cybersecurity researchers at Armis have detailed a set of nine security vulnerabilities, dubbed PwnedPiper, that were discovered in the system controlling the pneumatic tube networks used in thousands of hospitals worldwide. The exploitation of these vulnerabilities could lead to the disruption of services and the potential launch of ransomware attacks. The vulnerabilities were found in the Swisslog Healthcare Nexus Control Panel software, which powers the company's TransLogic pneumatic tube system (PTS) stations. The tubes are used by staff to send patient test samples and medication throughout the hospital, making them an essential part of providing care to patients. PwnedPiper includes hard-coded passwords, a privilege escalation vulnerability, and memory corruption bugs that can lead to remote code execution (RCE) and denial-of-service (DoS) attacks. The set of vulnerabilities also includes a design flaw in which firmware upgrades on the Nexus Control panel are unencrypted and do not require any cryptographic signature. The abuse of this design flaw could allow attackers to gain unauthenticated remote code execution privileges through the initiation of a firmware update procedure. According to Armis, an attacker would need access to the network via a phishing attack or breached remote desktop credentials to get to a Nexus Control Panel. Attackers could gain control over the tube network by exploiting the vulnerabilities in these systems. Following the disclosure of the vulnerabilities, Swisslog Healthcare made security updates available to address them and protect networks. Healthcare organizations that use Translogic's PTS are urged to apply the security updates and implement access controls, such as multi-factor authentication, across their networks. This article continues to discuss the potential exploitation and impact of the PwnedPiper vulnerabilities, as well as Swisslog Healthcare's response to this discovery. 

ZDNet reports "IoT: Security Researchers Warn of Vulnerabilities in Hospital Pneumatic Tube Systems"