HHS pledges $50M for autonomous vulnerability management solution for hospitals
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-43208 | Unauthenticated Deserialization RCE in NextGen Healthcare Mirth Connect CVE-2023-43208 is an unauthenticated remote code execution flaw in NextGen Healthcare Mirth Connect, a widely used healthcare integration engine, caused by incomplete patching of the earlier CVE-2023-37679 deserialization vulnerability. An attacker can trigger it by sending crafted serialized data to the network-exposed Mirth Connect service, requiring no authentication or user interaction (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N). Successful exploitation yields arbitrary code execution on the server, giving attackers a foothold in hospital and health-system networks that Mirth Connect uses to move clinical data (including PHI) between systems. All deployments running Mirth Connect versions before 4.4.1 are affected. The flaw is being actively exploited — CISA added it to the Known Exploited Vulnerabilities catalog on 2024-05-20 with known ransomware use, public proof-of-concept exploits exist, and EPSS estimates an 82.7% chance of exploitation within 30 days. Do: Upgrade Mirth Connect to version 4.4.1 or later as the CISA KEV required action, or discontinue use if upgrades are unavailable. Identify and restrict internet-exposed Mirth Connect instances (the service is commonly reachable on its web/admin interface), and hunt for signs of compromise given confirmed ransomware use. Because this bypasses the earlier CVE-2023-37679 fix, verify patch levels directly rather than assuming prior remediation. | 9.8 | 83% | KEV ransomware PoC ×2 |
| large≈10,000–30,000 internet-exposed Mirth Connect instances, plus many more internal deployments at thousands of hospitals and health systems |
Full article440 words · extracted from helpnetsecurity.com · click to collapse
As organizations in the healthcare sector continue to be a prime target for ransomware gangs and CISA warns about a vulnerability (CVE-2023-43208) in a healthcare-specific platform being leveraged by attackers, the Advanced Research Projects Agency for Health (ARPA-H) has announced the Universal PatchinG and Remediation for Autonomous DEfense (UPGRADE) program aimed at developing a vulnerability management platform for healthcare IT teams.
CVE-2023-43208 exploited by ransomware threat actors
CVE-2023-43208, an easily exploitable unauthenticated remote code execution vulnerability affecting NextGen HealthCare’s Mirth Connect data integration platform, has been patched by the company and publicly disclosed by Horizon3.ai researchers in October 2023.
CISA added it to its Known Exploited Vulnerabilities catalog on Monday, even though Microsoft Threat Intelligence found it being exploited by ransomware threat actors back in April.
That means that many months after the release of the patch, vulnerable internet-facing Mirth Connect instances were still available for attackers to exploit and use for initial access to healthcare organizations’ networks.
The UPGRADE program looks for healthcare vulnerability management solution
“While proactive vendors patch consumer products with software weaknesses in days or weeks, health care technology can take over a year to patch at scale,” ARPA-H says.
“Deploying security updates in hospitals is difficult because of the sheer number of internet-connected devices, limitations in health care IT resources, and low tolerance for device downtime needed to test and patch. Despite the size of the cybersecurity industry, health care sector challenges remain under addressed, even as more pieces of equipment are network-connected than ever before.”
The goal of the UPGRADE program is to create a security platform that will adapt to any hospital environment, proactively and autonomously simulate/evaluate the risk and potential impact of vulnerabilities, procure or develop a patch, test it in a model environment, and deploy it in a way that’s minimally disruptive to medical, IT, and other devices in use at healthcare delivery organizations.
“UPGRADE expects to bring together equipment manufacturers, cybersecurity experts, and hospital IT staff to develop a tailored and scalable software suite for hospital cyber-resilience,” says Andrew Carney, ARPA-H’s program manager for resilient systems.
“The program has four technical areas. Technical area 1 focuses on the creation of a vulnerability mitigation platform. Technical area 2 aims to create high-fidelity digital twins of equipment in hospital environments. Technical areas 3 and 4 seek to develop methods to rapidly and automatically detect software vulnerabilities and then confidently develop defenses for each.”
Investment in the program is expected to surpass $50 million. Applicants can propose solutions until June 18, 2024.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/05/23/healthcare-vulnerability-management/