CVE-2022-45611 – CVE-2022-45611 is an authentication bypass vuln... (How to Fix)

Q: What is the severity of CVE-2022-45611?

CVE-2022-45611 has a CVSS score of 9.8 (CRITICAL). CVE-2022-45611 is an authentication bypass vulnerability in Fresenius Kabi PharmaHelp 5.1.759.0 that allows attackers to capture user login credentials and gain escalated privileges. This affects healthcare organizations using this specific version of the PharmaHelp compounding software. Attackers could potentially access sensitive medical systems and data.

📋 TL;DR

CVE-2022-45611 is an authentication bypass vulnerability in Fresenius Kabi PharmaHelp 5.1.759.0 that allows attackers to capture user login credentials and gain escalated privileges. This affects healthcare organizations using this specific version of the PharmaHelp compounding software. Attackers could potentially access sensitive medical systems and data.

💻 Affected Systems

Products:

Fresenius Kabi PharmaHelp Compounder

Versions: 5.1.759.0

Operating Systems: Windows (assumed based on typical healthcare software deployment)

Default Config Vulnerable: ⚠️ Yes

Notes: Specifically affects version 5.1.759.0 of PharmaHelp compounding software used in hospital pharmacies.

📦 What is this software?

Pharmahelp Firmware by Fresenius Kabi

View all CVEs affecting Pharmahelp Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of medical compounding systems leading to medication errors, patient safety risks, and unauthorized access to protected health information (PHI).

🟠

Likely Case

Unauthorized access to the PharmaHelp system allowing manipulation of medication compounding data and theft of sensitive information.

🟢

If Mitigated

Limited impact with proper network segmentation, strong authentication controls, and monitoring in place.

🌐 Internet-Facing: MEDIUM - While the software may not be directly internet-facing, healthcare networks often have complex connectivity that could expose vulnerable systems.

🏢 Internal Only: HIGH - Healthcare networks frequently have lateral movement opportunities, and compromised credentials could lead to broader system access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires capturing user login information, suggesting credential theft or interception techniques.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Update to version provided by Fresenius Kabi (specific version not publicly documented)

Vendor Advisory: https://www.fresenius.com/sites/default/files/2023-11/Fresenius%20-%20CVE-2022-45611.pdf

Restart Required: Yes

Instructions:

1. Contact Fresenius Kabi support for the security update. 2. Apply the provided patch following vendor instructions. 3. Restart the PharmaHelp application and verify functionality.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate PharmaHelp systems from general network access and restrict to necessary pharmacy systems only.

Enhanced Authentication Controls

all

Implement multi-factor authentication and monitor for unusual login patterns.

🧯 If You Can't Patch

Implement strict network access controls to limit who can access PharmaHelp systems
Enable detailed logging and monitoring of all authentication attempts and user activities

🔍 How to Verify

Check if Vulnerable:

Check PharmaHelp version in application settings or About dialog - if version is 5.1.759.0, system is vulnerable.

Check Version:

Check within PharmaHelp application interface under Help > About or similar menu

Verify Fix Applied:

Verify version has been updated from 5.1.759.0 and confirm with Fresenius Kabi that the patch has been applied.

📡 Detection & Monitoring

Log Indicators:

Multiple failed login attempts followed by successful login from unusual locations
User accounts accessing systems at unusual times
Authentication logs showing credential capture patterns

Network Indicators:

Unusual network traffic to/from PharmaHelp systems
Credential harvesting attempts on network segments containing PharmaHelp

SIEM Query:

source="pharmahelp" AND (event_type="authentication" AND (result="failure" count>5 within 5min) OR (user_location changed suddenly))

📊 Metadata

CVE ID: CVE-2022-45611

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-522

Published: August 22, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-45611, you might also want to check these: