CVE-2021-37165
📋 TL;DR
A buffer overflow vulnerability in Swisslog Healthcare Nexus Panel's HMI3 Control Panel allows remote attackers to execute arbitrary code by sending specially crafted messages to the HMI TCP socket. This affects Swisslog Healthcare Nexus Panel systems running software versions before Nexus Software 7.2.5.7. The vulnerability can lead to complete system compromise.
💻 Affected Systems
- Swisslog Healthcare Nexus Panel
📦 What is this software?
Hmi 3 Control Panel Firmware by Swisslog Healthcare
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains full control of the medical device system, potentially disrupting hospital operations, compromising patient data, or manipulating medical equipment functionality.
Likely Case
Attackers exploit the vulnerability to install malware, establish persistence, and move laterally within hospital networks to access sensitive medical systems and data.
If Mitigated
With proper network segmentation and access controls, impact is limited to the specific vulnerable device, preventing lateral movement to critical medical systems.
🎯 Exploit Status
The PwnedPiper research by Armis includes detailed exploitation techniques and demonstrates remote code execution capabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nexus Software 7.2.5.7 or later
Vendor Advisory: https://www.swisslog-healthcare.com/en-us/customer-care/security-information/cve-disclosures
Restart Required: Yes
Instructions:
1. Contact Swisslog Healthcare support for the patch. 2. Schedule maintenance window. 3. Apply Nexus Software update to version 7.2.5.7 or later. 4. Restart the system as required. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Nexus Panel systems from general hospital networks and restrict access to HMI TCP socket (port 5001 typically)
Firewall Rules
allBlock external access to Nexus Panel systems and restrict internal access to authorized management stations only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems from critical medical networks
- Deploy intrusion detection systems to monitor for exploitation attempts on the HMI TCP socket
🔍 How to Verify
Check if Vulnerable:
Check the software version on the Nexus Panel interface. If version is below 7.2.5.7, the system is vulnerable.Check Version:
Check the software version through the Nexus Panel administrative interface or contact Swisslog Healthcare support for version verification.Verify Fix Applied:
Verify the software version shows 7.2.5.7 or higher after applying the patch.📡 Detection & Monitoring
Log Indicators:
- Unusual network connections to port 5001
- Multiple failed connection attempts to HMI socket
- Unexpected process creation on Nexus Panel
Network Indicators:
- Unusual traffic patterns to/from Nexus Panel systems
- Exploit-like payloads sent to port 5001
- Unexpected outbound connections from Nexus Panel
SIEM Query:
source_ip="*" AND dest_port=5001 AND (payload_size>normal OR pattern="buffer_overflow_indicators")🔗 References
- https://www.armis.com/PwnedPiper
- https://www.swisslog-healthcare.com
- https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37165-bulletin---overflow-in-hmiprocessmsg.pdf?rev=2e2678dab62b41ba999cd6d1e03974ca&hash=F465ACE2C7FAED826B52FE996E36ACEC
- https://www.swisslog-healthcare.com/en-us/customer-care/security-information/cve-disclosures#:~:text=CVE%20Disclosures%20%20%20%20Vulnerability%20Name%20%2C%20%20CVE-2021-37164%20%204%20more%20rows%20
- https://www.armis.com/PwnedPiper
- https://www.swisslog-healthcare.com
- https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37165-bulletin---overflow-in-hmiprocessmsg.pdf?rev=2e2678dab62b41ba999cd6d1e03974ca&hash=F465ACE2C7FAED826B52FE996E36ACEC
- https://www.swisslog-healthcare.com/en-us/customer-care/security-information/cve-disclosures#:~:text=CVE%20Disclosures%20%20%20%20Vulnerability%20Name%20%2C%20%20CVE-2021-37164%20%204%20more%20rows%20
