CVE-2019-10950
📋 TL;DR
This vulnerability affects Fujifilm medical imaging devices that expose telnet services without authentication. Attackers can gain unauthorized access to the underlying operating system, potentially compromising patient data and device functionality. Healthcare organizations using these specific Fujifilm devices are affected.
💻 Affected Systems
- Fujifilm FCR Capsula X
- Fujifilm FCR Carbon X
- Fujifilm FCR XC-2
📦 What is this software?
Cr Ir 357 Fcr Capsula X Firmware by Fujifilm
Cr Ir 357 Fcr Carbon X Firmware by Fujifilm
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to access/modify patient medical images, disrupt medical services, pivot to hospital networks, or deploy ransomware on medical devices.
Likely Case
Unauthorized access to device operating system leading to data theft, configuration changes, or installation of backdoors for persistent access.
If Mitigated
Limited impact if devices are properly segmented and telnet access is blocked at network boundaries.
🎯 Exploit Status
Exploitation requires only telnet client access to vulnerable device - no special tools or authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Fujifilm for specific firmware updates
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSMA-19-113-01
Restart Required: Yes
Instructions:
1. Contact Fujifilm support for firmware updates. 2. Apply firmware update following vendor instructions. 3. Verify telnet service is disabled or secured post-update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate medical devices on separate VLAN with strict firewall rules blocking telnet access
Disable Telnet Service
allIf device configuration allows, disable telnet service entirely
🧯 If You Can't Patch
- Implement strict network access controls to block all telnet traffic (port 23) to affected devices
- Monitor network traffic for telnet connections and implement intrusion detection rules
🔍 How to Verify
Check if Vulnerable:
Attempt telnet connection to device on port 23. If connection succeeds without authentication prompt, device is vulnerable.Check Version:
Check device display or management interface for firmware version informationVerify Fix Applied:
After patching, attempt telnet connection - should be rejected or require authentication. Check device firmware version matches patched version.📡 Detection & Monitoring
Log Indicators:
- Telnet connection attempts in device/system logs
- Unauthorized access attempts
Network Indicators:
- Telnet traffic (TCP/23) to medical devices
- Unusual outbound connections from medical devices
SIEM Query:
source_port=23 OR destination_port=23 AND (device_type=medical OR hostname CONTAINS 'FCR')