研究人员表示在明尼苏达州的特种医疗器械制造商史密斯医疗公司制造的Medfusion 4000无线注射器输液泵中存在八个安全漏洞，事实证明，在急性护理环境中使用的注射器输液泵可以被黑客远程访问并可以控制输液量，影响设备的预期操作。

[出自:jiwo.org]

Internet-of-things are turning every industry into the computer industry, making customers think that their lives would be much easier with smart devices. However, such devices could potentially be compromised by hackers.

There are, of course, some really good reasons to connect certain devices to the Internet.

But does everything need to be connected? Of course, not—especially when it comes to medical devices.

Medical devices are increasingly found vulnerable to hacking. Earlier this month, the US Food and Drug Administration (FDA) recalled 465,000 pacemakers after they were found vulnerable to hackers.

Now, it turns out that a syringe infusion pump used in acute care settings could be remotely accessed and manipulated by hackers to impact the intended operation of the device, ICS-CERT warned in an advisoryissued on Thursday.

An independent security researcher has discovered not just one or two, but eight security vulnerabilities in the Medfusion 4000 Wireless Syringe Infusion Pump, which is manufactured by Minnesota-based speciality medical device maker Smiths Medical.

The devices are used across the world for delivering small doses of medication in acute critical care, such as neonatal and pediatric intensive care and the operating room.

Some of these vulnerabilities discovered by Scott Gayou are high in severity that can easily be exploited by a remote attacker to "gain unauthorized access and impact the intended operation of the pump."

According to the ICS-CERT, "Despite the segmented design, it may be possible for an attacker to compromise the communications module and the therapeutic module of the pump."

The high-severity flaws include:

• A buffer overflow bug (CVE-2017-12718) that could be exploited for remote code execution on the target device in certain conditions.
• Lack of authentication (CVE-2017-12720) if the pump is configured to allow FTP connections.
• Presence of hard-coded credentials (CVE-2017-12724) for the pump's FTP server.
• Lack of proper host certificate validation (CVE-2017-12721), leaving the pump vulnerable to man-in-the-middle (MitM) attacks.