Fujifilm has a plan in place to handle uncontrolled resource consumption and improper access control vulnerabilities in its FCR Capsula X/Carbon X, according to a report with NCCIC.
Successful exploitation of these remotely exploitable vulnerabilities, discovered by Marc Ruef and Rocco Gagliardi of Scip AG, could result in a denial-of-service condition in affected cassette reader units, causing potential image loss or device unavailability. Attackers could gain unauthorized access to the underlying operating system, allowing arbitrary code execution.
The following models and versions of Fujifilm Computed Radiography cassette readers are affected:
• CR-IR 357 FCR Carbon X
• CR-IR 357 FCR XC-2
• CR-IR 357 FCR Capsula X
In one vulnerability, the device is susceptible to a denial-of-service condition as a result of an overflow of TCP packets, which requires the device to be manually rebooted.
CVE-2019-10948 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.
In addition, the device provides insecure telnet services that lack authentication requirements. An attacker who successfully exploits this vulnerability may be able to access the underlying operating system.
CVE-2019-10950 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.
The products see use mainly in the healthcare and public health sectors. They also see action on a global basis.
No known public exploits specifically target these vulnerabilities. However, an attacker with low skill level could leverage the vulnerabilities.
Japan-based Fujifilm said the CR-IR 357 system can be configured with what they call Secure Host functionality.
This configuration of the software instructs CR-IR 357 to ignore all network traffic other than from the IP address of the Fujifilm image acquisition console. However, this configuration prevents more than one image acquisition console to share the CR-IR 357 Reader Unit. If the user has not implemented Reader Unit sharing, they may contact Fujifilm to request Secure Host functionality be enabled. If the user has implemented Reader Unit sharing, they should contact Fujifilm to discuss available options. Fujifilm can be contacted at 888-FUJI-MED (888-385-4633). Users outside the United States should contact their Fujifilm contact.
Fujifilm recommends the first line of defense should be a compensating control of securing the user’s network. Measures should be taken to ensure only authorized devices and personnel have access to the network. Public or guest networks should be segmented, or users should use a VLAN to segregate public traffic from the private network. Administrative and technical controls should also be implemented.