Bulletins
CRITICAL
BD is aware of and currently monitoring a remote code execution vulnerability in the Microsoft Windows Print spooler service, known as PrintNightmare, affecting all versions of Microsoft Windows Operating Systems. This third-party vulnerability is not specific to BD or our products. BD is providing this update to let customers know which BD products could be affected by this third-party vulnerability.
BD has not received any reports of this vulnerability being exploited on BD products.
- CVE-2021-34527:
- A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploits this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
BD products in scope
The product list below identifies existing BD products that are in scope of this Microsoft vulnerability. The list may be updated as more products are identified. In addition, this list does not indicate the patch or device status. Please check back periodically for updates.
The BD products listed below are in scope for CVE-2021-34527:
- Arctic Sun™ Analytics
- Arctic Sun™ Stat
- BD BACTEC™ 9240/9120
- BD BACTEC™ FX
- BD BACTEC™ FX40
- BD Accuri™ C6 Plus
- BD Assurity Linc™
- BD COR™ System
- BD DataLink™
- BD EpiCenter™
- BD FACSAria™ Fusion with FACSDiva™
- BD FACSAria™ II with FACSDiva™
- BD FACSAria™ III with FACSDiva™
- BD FACSCanto™ 10-color with FACSDiva™
- BD FACSCanto™ II Clinical with FACSCanto™ Clinical
- BD FACSCanto™ II FACSDiva™
- BD FACSCanto™ II Clinical with FACSCanto™ Clinical
- BD FACSCelesta™ with FACSDiva™
- BD FACSDuet™
- BD FACSLink™
- BD FACSLyric™ with FACSuite™ Clinical
- BD FACSMelody™
- BD FACS™ Sample Prep Assistant (SPA) III
- BD FACSymphony™ A3/A5 with FACSDiva™
- BD FACSymphony™ S6 with FACSDiva™
- BD FocalPoint™ GSRS/LLS/SLS
- BD MAX™ System
- BD Phoenix™ M50
- BD Pyxis™ CIISafe™
- BD Pyxis™ MedStation™ ES
- BD Pyxis™ Server ES
- BD Pyxis™ IV Prep
- BD Pyxis™ Logistics (Pyxis™ Pharmogistics™)
- BD Pyxis™ PharmoPack™
- BD Pyxis™ SupplyStation™
- BD Rowa™ - Dose
(Windows 10 platform) - BD Rowa™ - Dose
(Windows 7 Workstations only) - BD Rowa™ – Vmax
- BD Rowa™ – Smart
- BD Rowa™ – ProLog
- BD Synapsys™ Informatics Solution
- BD Totalys™ MultiProcessor Instrument
- BD Totalys™ MultiProcessor Remote Station
- BD Totalys™ SlidePrep
- BD Viper LT™
- BD Intelliport™
- BD LSR II with FACSDiva™
- BD LSRFortessa™ with FACSDiva™
- BD LSRFortessa™ X-20 with FACSDiva™
- BD Sensica UO
- BD Sherlock 3CG™ Standalone Tip Confirmation Systems
- BD Site~Rite® 8 Ultrasound Systems
- BD Veritor™ Plus Connect NUC
BD is currently working to test and validate the patch(es) for BD products that use the affected third-party software. Please refer to the Bulletins and Patches page for all approved product security patching notifications.
Additionally, BD recommends the following compensating controls for customers using BD products in scope:
- Execute updates to malware protection, where available
- Ensure data has been backed up and stored according to your individual processes and disaster recovery procedures
- Disable any unnecessary accounts, protocols, and services
- Do not allow unauthenticated users access to the network
Customers that maintain patches independent of BD automated delivery should ensure these actions are performed as the acting responsible entity to maintain the correct security posture of the system(s) and ensure the proper Windows Print spooler service patches have been applied:
For product-or site-specific concerns, contact your BD service representative. If you believe a BD device on your network has been impacted by this third-party vulnerability, disconnect the device from the network and contact your BD service representative immediately.