{"id":46218,"date":"2022-04-13T13:05:20","date_gmt":"2022-04-13T13:05:20","guid":{"rendered":"http:\/\/77237c6c-7fa5-47fe-a756-840d6168f88c"},"modified":"2022-04-13T13:05:20","modified_gmt":"2022-04-13T13:05:20","slug":"critical-vulnerabilities-uncovered-in-hospital-robots","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-uncovered-in-hospital-robots\/","title":{"rendered":"Critical vulnerabilities uncovered in hospital robots"},"content":{"rendered":"
<\/div>\n

Vendor Aethon has patched five critical vulnerabilities in hospital robots used to deliver medical supplies. <\/p>\n

The world of health-related cybersecurity issues is still relatively untouched. In recent years, we’ve seen the impact of ransomware outbreaks<\/a> in hospitals; software vulnerabilities including those that could, in theory, stop a pacemaker from working<\/a>, and countless patient data leaks at providers worldwide.<\/p>\n

However, unless there’s a clear-cut financial benefit, many cyberattackers will ignore medical devices in favor of hitting businesses likely to provide them with illicit revenue. <\/p>\n

This doesn’t mean that vendors, or defenders, should ignore vulnerabilities and security issues surrounding medicine, especially as digital health, personalized medicine, and remote care continue to develop. <\/p>\n

Medical devices can fall short of adequate security measures, as recently revealed in Cynerio<\/a>‘s public disclosure of Jekyllbot:5<\/a> (.PDF), five critical vulnerabilities in Aethon TUG robots<\/a>. <\/p>\n

Read on: <\/strong>Black Hat: How your pacemaker could become an insider threat to national security<\/strong><\/a><\/p>\n

Aethon’s mobile robots are autonomous devices used by hundreds of hospitals to perform basic, repetitive tasks to augment existing workforces. <\/p>\n

TUGs run errands including medicine delivery, cleaning, and dropping off linen and other supplies to healthcare professionals. Stanford<\/a> is a healthcare provider that uses the robots in drug deliveries, which can move at 2mph down pre-determined routes. <\/p>\n

According to Cynerio, the five vulnerabilities allow attackers to take over a robot’s activities, including taking photos; snooping on the hospital in real-time via camera feeds, accessing patient records; disrupting or blocking drug delivery, all of which could impact patient care. <\/p>\n

In addition, the team says the bugs could be used to hijack user sessions or “take control of the robot’s movement and crash them into people or objects, or use them to harass patients and staff.” <\/p>\n

The vulnerabilities, now assigned CVEs, are below: <\/p>\n