The Department of Homeland Security's Industrial Control System Computer Emergency Response Team (ICS-CERT) has issued an alert warning of four vulnerabilities in multiple medical molecular imaging systems from Siemens. All of these systems have publicly available exploits that could allow an attacker to execute code remotely—potentially damaging or compromising the safety of the systems. "An attacker with a low skill would be able to exploit these vulnerabilities," ICS-CERT warned.

Siemens identified the vulnerabilities in a customer alert on July 26, warning that the vulnerabilities were highly critical—giving them a rating of 9.8 out of a possible 10 using the Common Vulnerability Scoring System. The systems affected include Siemens PET/CT, SPECT/CT and SPECT scanners and medical imaging workflow systems based on Windows 7. Standalone CT scanners are not affected by the vulnerabilities.

One of the vulnerabilities is in the built-in Window Web server running on the systems. "An unauthenticated remote attacker could execute arbitrary code by sending specially crafted HTTP requests to the Microsoft Web server (port 80/tcp and port 443/tcp) of affected devices," Siemens warned in its alert. The bug in the Web server software allows code injection onto the devices.

The other three vulnerabilities are in the HP Client Automation Service software used to remotely manage the software deployed to the systems. They allow the remote injection of code using a crafted network request and then the execution of that code by exploiting a memory buffer bug. Another remote attack could be used to bypass access controls and elevate the privileges of the attacker.

Siemens is "preparing updates" for the affected systems, but in the meantime, the company has urged customers to either run their systems on isolated network segments or disconnect them from networks and run them in standalone mode—reconnecting them to the network only after Siemens techs have delivered a patch. DHS's ICS-CERT further warns that healthcare providers should:

Minimize network exposure for all medical devices and/or systems, and ensure that they are not accessible from the Internet.

Locate all medical devices and remote devices behind firewalls, and isolate them from the business network.

When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.

Many hospitals and clinics don't have these most basic security provisions. As noted in a recent report to Congress by the Department of Health and Human Services' Health Care Industry Cybersecurity Task Force, "The majority of health delivery organizations lack full-time, qualified security personnel."

As a result, systems like the Siemens scanners are particularly at risk from cryptoransomware and other malware attacks that spread laterally on networks, because medical systems often share the same network as administrative systems. In such a setup, a click on an e-mail attachment or unpatched legacy Web server software could trigger a breach that could effectively shut hospitals down. That's precisely what happened with many hospitals in Britain's National Health Service with the spread of WannaCry, and it also happened in hospitals such as Hollywood Presbyterian Hospital in Los Angeles and the MedStar hospital system in Maryland last year.