Five zero-day vulnerabilities have been identified in Aethon TUG autonomous mobile robots, which are used in hospitals worldwide for transporting goods, medicines, and other medical supplies. Hospital robots are attractive targets for hackers. If access to the robots is gained, a variety of malicious actions could be performed.
"Successful exploitation of these vulnerabilities could cause a denial-of-service condition, allow full control of robot functions, or expose sensitive information," the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said in an advisory published this week.
“The worst-case scenario is a total disruption of critical care and violation of patient privacy, and JekyllBot:5 would give attackers the means to compromise security in ways they would not otherwise be able to, especially in terms of physical security,” said Brodie.
Aethon TUG smart autonomous mobile robots are used in hospitals around the world to deliver medication, transport clinical supplies, and independently navigate around to perform different tasks such as cleaning floors and collecting meal trays.
Collectively dubbed "JekyllBot:5" by Cynerio, the flaws reside in the TUG Homebase Server component, effectively allowing attackers to impede the delivery of medications, surveil patients, staff, and hospital interiors through its integrated camera, and gain access to confidential information.
Even worse, an adversary could weaponize the weaknesses to hijack legitimate administrative user sessions in the robots' online portal and inject malware to propagate further attacks at health care facilities.
The exploitation of the flaws could have given "attackers an access point to laterally move through hospital networks, perform reconnaissance, and eventually carry out ransomware attacks, breaches, and other threats," the healthcare IoT security firm said.
The list of shortcomings, which were discovered late last year during an audit on behalf of a healthcare provider client, is below -
- CVE-2022-1070 (CVSS score: 9.8) - An unauthenticated attacker can connect to the TUG Home Base Server websocket to take control of TUG robots.
- CVE-2022-1066 (CVSS score: 8.2) - An unauthenticated attacker can arbitrarily add new users with administrative privileges and delete or modify existing users.
- CVE-2022-26423 (CVSS score: 8.2) - An unauthenticated attacker can freely access hashed user credentials.
- CVE-2022-27494 (CVSS score: 7.6) - The "Reports" tab of the Fleet Management Console is vulnerable to stored cross-site scripting attacks when new reports are created or edited.
- CVE-2022-1059 (CVSS score: 7.6) - The "Load" tab of the Fleet Management Console is vulnerable to reflected cross-site scripting attacks.
“Hospitals need solutions that go beyond mere healthcare IoT device inventory checks to proactively mitigate risks and apply immediate remediation for any detected attacks or malicious activity,” said Leon Lerman, founder and CEO of Cynerio. “Any less is a disservice to patients and the devices they depend on for optimal healthcare outcomes.”
