CVE-2016-8355
📋 TL;DR
This vulnerability allows authenticated users of Smiths-Medical CADD-Solis Medication Safety Software to gain elevated SQL database privileges. Attackers could modify drug libraries, add/delete users, and change permissions, potentially affecting patient safety. Affected versions include 1.0, 2.0, 3.0, and 3.1 of the software.
💻 Affected Systems
- Smiths-Medical CADD-Solis Medication Safety Software
📦 What is this software?
Cadd Solis Medication Safety Software by Smiths Medical
View all CVEs affecting Cadd Solis Medication Safety Software →
Cadd Solis Medication Safety Software by Smiths Medical
View all CVEs affecting Cadd Solis Medication Safety Software →
⚠️ Risk & Real-World Impact
Worst Case
Malicious actor modifies drug libraries to deliver incorrect medication doses, potentially causing patient harm or death.
Likely Case
Unauthorized privilege escalation leading to unauthorized system access and potential data manipulation.
If Mitigated
Limited impact with proper access controls, network segmentation, and physical security preventing unauthorized access.
🎯 Exploit Status
Requires authenticated access but then provides easy privilege escalation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.2
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSMA-16-306-01
Restart Required: Yes
Instructions:
1. Contact Smiths-Medical for patch details. 2. Apply Version 3.2 update. 3. Restart affected systems. 4. Verify proper functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate CADD-Solis systems from general network access
Access Control Hardening
allImplement strict user access controls and monitoring
🧯 If You Can't Patch
- Implement strict physical access controls to prevent unauthorized access to infusion pumps
- Enable detailed logging and monitoring of all database access and privilege changes
🔍 How to Verify
Check if Vulnerable:
Check software version in application settings or system informationCheck Version:
Check application About menu or system information panelVerify Fix Applied:
Verify version is 3.2 or later and test privilege escalation attempts📡 Detection & Monitoring
Log Indicators:
- Unauthorized privilege escalation attempts
- Unexpected database modifications
- User permission changes outside normal workflow
Network Indicators:
- Unusual database access patterns
- SQL queries from unauthorized users
SIEM Query:
source="cadd-solis" AND (event_type="privilege_escalation" OR event_type="user_permission_change")