As many as five security vulnerabilities have been addressed in Aethon Tug hospital robots that could enable remote attackers to seize control of the devices and interfere with the timely distribution of medication and lab samples.
“Successful exploitation of these vulnerabilities could cause a denial-of-service condition, allow full control of robot functions, or expose sensitive information,” the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said in an advisory published this week.
Aethon TUG smart autonomous mobile robots are used in hospitals around the world to deliver medication, transport clinical supplies, and independently navigate around to perform different tasks such as cleaning floors and collecting meal trays.
Collectively dubbed “JekyllBot:5” by Cynerio, the flaws reside in the TUG Homebase Server component, effectively allowing attackers to impede the delivery of medications, surveil patients, staff, and hospital interiors through its integrated camera, and gain access to confidential information.
Even worse, an adversary could weaponize the weaknesses to hijack legitimate administrative user sessions in the robots’ online portal and inject malware to propagate further attacks at health care facilities.
The exploitation of the flaws could have given “attackers an access point to laterally move through hospital networks, perform reconnaissance, and eventually carry out ransomware attacks, breaches, and other threats,” the healthcare IoT security firm said.
The list of shortcomings, which were discovered late last year during an audit on behalf of a healthcare provider client, is below – Read more:https://bit.ly/3McJCI1
You can also read this: Into the Breach: Breaking Down 3 SaaS App Cyber Attacks in 2022