CVE-2020-27376
📋 TL;DR
The Dr Trust USA iCheck Connect BP Monitor version 1.2.1 lacks proper authentication mechanisms, allowing unauthorized access to device functions and data. This affects users of this specific blood pressure monitor model who use the vulnerable software version.
💻 Affected Systems
- Dr Trust USA iCheck Connect BP Monitor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could remotely access and manipulate blood pressure readings, potentially altering medical data or disrupting device functionality, which could lead to incorrect medical decisions.
Likely Case
Unauthorized users could access sensitive health data stored on the device or transmitted by it, violating privacy and potentially exposing personal health information.
If Mitigated
With proper network segmentation and access controls, the impact would be limited to isolated network segments, preventing external exploitation.
🎯 Exploit Status
Missing authentication vulnerabilities typically require minimal technical skill to exploit once the attack vector is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Contact Dr Trust USA for firmware update availability
2. If update available, follow manufacturer instructions to update device firmware
3. Verify the device is running a version later than 1.2.1
🔧 Temporary Workarounds
Network Isolation
allIsolate the BP monitor on a separate network segment to prevent unauthorized access
Physical Access Control
allRestrict physical access to the device and ensure it's only used in controlled environments
🧯 If You Can't Patch
- Disconnect the device from any network when not in active use
- Implement strict network access controls and monitor for unauthorized connection attempts
🔍 How to Verify
Check if Vulnerable:
Check device firmware version through device interface or manufacturer app; if version is 1.2.1, device is vulnerableCheck Version:
Not applicable - check through device interface or manufacturer applicationVerify Fix Applied:
Verify firmware version is updated to a version later than 1.2.1 through device interface📡 Detection & Monitoring
Log Indicators:
- Unauthorized connection attempts to device
- Unexpected data transmission from device
Network Indicators:
- Unexpected network traffic to/from device IP
- Connection attempts from unauthorized IP addresses
SIEM Query:
Not applicable - custom monitoring required for medical device traffic🔗 References
- http://dr.com
- https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitor
- https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5c
- http://dr.com
- https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitor
- https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5c
