JekyllBot:5 Flaws Let Attackers Take Control of Aethon TUG Hospital Robots

As many as five security vulnerabilities have been addressed in
Aethon Tug hospital robots that could enable remote attackers to
seize control of the devices and interfere with the timely
distribution of medication and lab samples.

“Successful exploitation of these vulnerabilities could cause a
denial-of-service condition, allow full control of robot functions,
or expose sensitive information,” the U.S. Cybersecurity and
Infrastructure Security Agency (CISA) said^[1]
in an advisory published this week.

Aethon TUG smart autonomous mobile robots are used in hospitals
around the world to deliver medication, transport clinical
supplies, and independently navigate around to perform different
tasks such as cleaning floors and collecting meal trays.

Collectively dubbed “JekyllBot:5^[2]” by Cynerio, the flaws
reside in the TUG Homebase Server component, effectively allowing
attackers to impede the delivery of medications, surveil patients,
staff, and hospital interiors through its integrated camera, and
gain access to confidential information.

Even worse, an adversary could weaponize the weaknesses to
hijack legitimate administrative user sessions in the robots’
online portal and inject malware to propagate further attacks at
health care facilities.

The exploitation of the flaws could have given “attackers an
access point to laterally move through hospital networks, perform
reconnaissance, and eventually carry out ransomware attacks,
breaches, and other threats,” the healthcare IoT security firm
said.

The list of shortcomings, which were discovered late last year
during an audit on behalf of a healthcare provider client, is below
–

• CVE-2022-1070 (CVSS score: 9.8) – An
  unauthenticated attacker can connect to the TUG Home Base Server
  websocket to take control of TUG robots.
• CVE-2022-1066 (CVSS score: 8.2) – An
  unauthenticated attacker can arbitrarily add new users with
  administrative privileges and delete or modify existing users.
• CVE-2022-26423 (CVSS score: 8.2) – An
  unauthenticated attacker can freely access hashed user
  credentials.
• CVE-2022-27494 (CVSS score: 7.6) – The
  “Reports” tab of the Fleet Management Console is vulnerable to
  stored cross-site scripting attacks when new reports are created or
  edited.
• CVE-2022-1059 (CVSS score: 7.6) – The “Load”
  tab of the Fleet Management Console is vulnerable to reflected
  cross-site scripting attacks.

“These zero-day vulnerabilities required a very low skill set
for exploitation, no special privileges, and no user interaction to
be successfully leveraged in an attack,” Cynerio’s Asher Brass
said.

“If attackers were able to exploit JekyllBot:5, they could have
completely taken over system control, gained access to real-time
camera feeds and device data, and wreaked havoc and destruction at
hospitals using the robots.”