Unsigned firmware update

1. Summary

The firmware update procedure of the Swisslog Translogic Pneumatic Tube System (PTS) Nexus Control Panel — also marketed as the HMI3 Control Panel — accepts firmware images over the network without verifying any cryptographic signature, and without authenticating or encrypting the channel [1][2]. A network-reachable, unauthenticated attacker who understands the update protocol can upload crafted firmware that the device installs and runs as trusted [3][5]. Because the attacker’s code executes as firmware beneath the application layer, the result is persistent, unauthenticated remote code execution and full control of the station [3][7]. It is the most severe of the nine “PwnedPiper” flaws disclosed by Armis and, uniquely among them, was not fixed in Nexus Software 7.2.5.7 [2][5].

2. Affected products & versions

3. The vulnerability in detail

The defect lives in the firmware update procedure of the Swisslog Translogic PTS Nexus Control Panel, the operator-facing HMI running on the HMI3 board and reachable over a hospital’s IT network via Ethernet [1][8]. In a Translogic deployment, these control panels sit at the tube stations and coordinate with a central Station Control Computer (SCC) to route carriers — the physical capsules that move blood samples, medications, and specimens between departments. The panel therefore straddles ordinary IT reachability and clinically significant physical actuation, which is what makes a code-execution flaw on it consequential rather than merely inconvenient.

The root cause is straightforward and, once stated, unambiguous: when the panel receives a firmware image via its update (“File Upload”) mechanism, nothing checks that the image is authentic or intact [1][5]. There is no verification of a cryptographic signature over the firmware, and the update itself travels over a channel that is neither authenticated nor encrypted [2][3]. Two things are therefore simultaneously missing — proof of who produced the image (signature) and proof that the requester is authorized to push it (authentication). The device implicitly trusts whatever firmware it is handed. This is why the finding carries two overlapping CWEs: CWE-347, Improper Verification of Cryptographic Signature, which names the core defect — the firmware-loading code never validates a signature that would bind the image to the legitimate vendor before accepting and executing it — and CWE-434, Unrestricted Upload of File with Dangerous Type, which captures the delivery vector, where the upload endpoint accepts a dangerous file (a full firmware image) that becomes executable code on the device [1]. The panel cannot tell attacker firmware apart from Swisslog firmware, so it runs both.

The trigger mechanism has no exotic preconditions. The attacker needs only network reachability to a Nexus Control Panel on the hospital IT network and an understanding of the update protocol [8]. There is no authentication step to defeat, no privilege to escalate from, no user interaction to socially engineer, and no physical or RF adjacency required [8]. The NVD vector encodes exactly this: attack vector Network, attack complexity Low, privileges required None, user interaction None [1]. Given that posture, the exploitation chain is short and mechanical:

1. The attacker establishes a foothold on the hospital IT network that hosts PTS stations. A compromised IP camera is a plausible pivot onto the same flat network [8].
2. From that foothold, the attacker reaches the Nexus HMI3 Control Panel’s firmware-update file-upload interface [3][8].
3. The attacker uploads a crafted firmware image. Because the channel is unauthenticated and no signature is checked, the panel accepts the image as legitimate [1][5].
4. The malicious firmware installs and executes as trusted, yielding unauthenticated remote code execution and full control of the station [3][7].
5. Because the attacker now owns the firmware — a layer beneath the application — the compromise persists across reboots and application-level controls, and the same technique repeats against every networked station, scaling a single-device flaw into fleet control [3][6].

The step-4-to-5 transition is the crux for a defender: this is not a transient application exploit that a restart clears. Ownership of the firmware trust root means the attacker’s code is what boots, so remediation requires signature-enforcing reprovisioning rather than a reboot or a config change.

4. Discovery & timeline

CVE-2021-37160 was discovered and disclosed by Armis Security as one of the nine “PwnedPiper” vulnerabilities in the Translogic Nexus Control Panel, presented publicly at Black Hat US 2021 [3][5]. Armis reported the findings to Swisslog on May 1, 2021 [5]. Swisslog released Nexus Software 7.2.5.7 in July 2021, which fixed the other eight CVEs but left CVE-2021-37160 unresolved, with a fix promised for a future release [2][5]. NVD published the record on August 2, 2021 [1]. Around August 3, 2021, CISA issued ICS Medical Advisory ICSMA-21-215-01 and HHS HC3 issued a PwnedPiper sector alert, giving the flaws official government and healthcare-sector coverage [2][4].

5. Technical reference

• CVE: CVE-2021-37160 [1]
• CWE: CWE-347 (Improper Verification of Cryptographic Signature); NVD also lists CWE-434 (Unrestricted Upload of File with Dangerous Type) [1]
• CVSS v3.1: Base 9.8 (Critical) — vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [1]. The key metrics: AV:N (network-reachable), PR:N + UI:N (no credentials, no victim interaction), and C:H/I:H/A:H (full firmware compromise breaks confidentiality, integrity, and availability of the station at once). S:U (scope unchanged) is worth flagging as a scoring artifact — CVSS scores the vulnerable component in isolation, so it does not capture the fleet-wide reuse that the CFSE analysis treats as a distinct systemic path.
• CVSS v2.0: Base 7.5 [1]
• Code / commit refs: none public; the update mechanism is described by NVD only as “File Upload,” with no port, protocol, or wire-format detail disclosed [1]

6. Consequence & CFSE path analysis

Real-world consequence: if this flaw is exploited, the attacker replaces the station’s firmware with their own and the device can no longer be trusted to be running vendor code. That is an irreversible loss of the station’s firmware trust root: rebooting or reinstalling the application does not evict the attacker, and recovery requires signature-enforcing reprovisioning. Because PTS stations move blood, medications, and specimens, and because the same unsigned-update mechanism exists on every networked station, a single compromise can become deployment-wide control over tube routing and station availability.

Why the CFSE Path Score differs from CVSS: CVSS v3.1 renders this as a single 9.8 with S:U — one component, badly broken. CFSE instead decomposes CVE-2021-37160 into two co-dominant risk paths, because the nature of the consequence and the scope of recovery differ along two axes that a single scalar cannot express. CVSS’s Scope: Unchanged in particular hides the fleet dimension entirely.

• Path verdict: EMERGENCY (the worst of the two paths).
• Path 1 — FIRMWARE_TRUST_ROOT (authority family): EMERGENCY. Models the network-reachable, unauthenticated update path that accepts unsigned firmware. Once the update protocol is understood there is no cryptographic signature check, so attacker code installs as trusted firmware beneath application controls, causing an irreversible loss of the station’s firmware trust root that requires signature-enforcing reprovisioning to recover.
• Path 2 — FLEET_CONTROL_PLANE (systemic family): base CRITICAL, uplifted to EMERGENCY. Takes the same shared unsigned-update mechanism and repeats it across networked stations, turning a single-device weakness into deployment-wide command authority over tube routing and station availability. Its base band is CRITICAL but it is uplifted to EMERGENCY because the path is fleet-reachable and recovery demands coordinated, deployment-wide verification or reprovisioning.
• Both paths carry maximal exposure (RE4/EC4/EX4) derived from NVD’s AV:N/PR:N vector, treat the PTS’s movement of blood/medication/specimens as safety-significant, and note the issue is only partially mitigated (v7.2.5.7 fixed the other PwnedPiper bugs but not this one) [2][5].
• The overall path_verdict is EMERGENCY, with the dominant consequence being loss of the device’s firmware trust root.

7. Remediation & mitigations

• Vendor fix: Nexus Software 7.2.5.7 remediated the other eight PwnedPiper CVEs but only mitigated CVE-2021-37160; a full fix was promised for a later release, and no definitive fixed version or date for this CVE appears in the sources [2][5]. Operators cannot assume upgrading to 7.2.5.7 closes this specific bug.
• Restrict management access: deploy ACLs that restrict station-to-central-server (SCC) communication, limiting which hosts can reach the control panel’s network interfaces and reducing the reachability the exploit depends on [2].
• Block Telnet (port 23): an official CISA mitigation for the PwnedPiper set; relevant here because it shrinks the panel’s exposed network surface, though it is not itself the update channel [2].
• Network detection: deploy IDS with Snort rules and monitoring for the PTS/HMI3 traffic to detect anomalous firmware-upload activity, since the update channel is unauthenticated and unencrypted and therefore observable [5].
• Segmentation: because the illustrative exploit path pivots from a compromised IP camera on the same network, isolating PTS stations from general IT/IoT VLANs directly undercuts the foothold-to-panel step [8].

8. Sources

[1] NVD — CVE-2021-37160 — NVD / NIST — https://nvd.nist.gov/vuln/detail/CVE-2021-37160 — Canonical CVE record: confirms the firmware-validation defect in the HMI3 Control Panel / Nexus Panel before 7.2.5.7, CWE-347 and CWE-434, and both CVSS scores (3.1 base 9.8, 2.0 base 7.5). — primary-advisory.

[2] Swisslog Healthcare Translogic PTS | CISA (ICSMA-21-215-01) — CISA / ICS-CERT — https://www.cisa.gov/uscert/ics/advisories/icsma-21-215-01 — Official ICS Medical Advisory: enumerates all nine CVEs, confirms CVE-2021-37160 is unresolved by 7.2.5.7 and slated for a future release, and gives official mitigations (block Telnet 23, station-to-SCC ACLs). — primary-advisory.

[3] PwnedPiper | Armis — Armis Security — https://www.armis.com/research/pwnedpiper/ — Original discoverer writeup: the unauthenticated/unsigned firmware upgrade enabling persistence and RCE, deployment scope (>80% of major North American hospitals, ~2,300+), May 2021 disclosure, and that all issues except CVE-2021-37160 were fixed in 7.2.5.7. — researcher-primary.

[4] PwnedPiper Sector Alert (TLP:WHITE) — HHS HC3 — https://www.hhs.gov/sites/default/files/pwnedpiper-sector-alert-tlpwhite.pdf — Healthcare-sector alert on operational and patient-safety impact of PTS compromise; supports the physical-safety and fleet-scale reasoning. — primary-advisory.

[5] PwnedPiper critical bug set impacts major hospitals in North America — BleepingComputer — https://www.bleepingcomputer.com/news/security/pwnedpiper-critical-bug-set-impacts-major-hospitals-in-north-america/ — Corroborates the nine CVEs, the unsigned-firmware/persistence angle, patch status (7.2.5.7 fixes all but this one), and recommended mitigations. — reputable-press.

[6] ‘PwnedPiper’: Devastating Bugs in >80% of Hospital Pneumatics — Threatpost — https://threatpost.com/pwnedpiper-bugs-hospital-pneumatics/168277/ — Vulnerability-class breakdown and fleet/network-takeover plus ransomware modeling supporting the FLEET_CONTROL_PLANE path. — reputable-press.

[7] PwnedPiper PTS Security Flaws Threaten 80% of Hospitals in the U.S. — The Hacker News — https://thehackernews.com/2021/08/pwnedpiper-pts-security-flaws-threaten.html — Secondary corroboration of the unsigned firmware update enabling persistence and RCE, deployment scale, and the unresolved status of this CVE. — reputable-press.

[8] Flaws in Pneumatic Tube System Can Facilitate Cyberattacks on North American Hospitals — SecurityWeek — https://www.securityweek.com/flaws-pneumatic-tube-system-can-facilitate-cyberattacks-north-american-hospitals/ — Confirms Armis attribution, network reachability, HMI3-board-over-Ethernet access, “crafted packets with no auth,” and the compromised-IP-camera pivot; notes 7.2.5.7 patches seven of eight types. — reputable-press.