## 5 Evaluation: A Healthcare Scenario
### Implementation of the Attack Path Generation
#### 5.2.5 Threat Actor and User Profile
\begin{table}
\begin{tabular}{c c} \hline \hline
**Asset** & **Vulnerabilities \& Exploitability** \\ \hline \hline \multirow{7}{*}{A1 = Braun’s Infusion Pump} & A1,V1 = Lack of input validation provides command line access and privilege escalation. TA requires in the same network as device \\  & CVE-2021-38386, A1,V3 = V1H/8 \\  & AVA-A/CL/PRN/UIN/SU/C/CH/LH/AH \\ \cline{2-3}  & A1,V2 = Unrestricted file upload that can overwritten critical files due to privilege escalation \\  & CVE-2021-33884, A1,V4 = V1H/9.1 \\  & CVS8.3.1/AV/N/ACL/PRN/UIN/SU/C/CN/LH/AH \\ \hline \multirow{7}{*}{A2 = Medtronic MiniMed 508 insulin pump} & A2,V1 = Lack of security (authentication and authorization) in RF communication protocol with other devices such as blood glucose meter and glucose sensor transmitters. TA requires in the same network as device can inject or intercept data and change pump settings \\  & CVE-2019-1094, A61 = A1 = V1H/8.8 \\  & CVS8.3.0/AV/A/ACL/PRN/UIN/SU/C/CH/LH/AH \\ \hline \multirow{7}{*}{A3 = Insulin Management System} & A3,V1 = improper access control in the wireless RF communication protocol allows local TA to intercept or modify \\  & & \\  & & \\  & CVE-2020-106272 \(\Delta\)3,V1 = V1H/8.1 \\  & CVS8.3.1/AV/A/ACL/PRN/UIN/SU/C/CH/LH/AH-AN \\ \hline \multirow{7}{*}{A4 = IoT device Philips Hue light bulb} & A4,V1 = communication protocol can be abused to remotely installed microshanke firmware in the light bulb as remote \\  & code execution through buffer overflow and spread to other IoT devices that use Zigbee communication protocol. \\  & CVS8.3.1/AV/A/ACL/PRN/UIN/SU/C/CH/LH/AH \\ \hline \multirow{7}{*}{A5 = Router (Buffalo, Cisco RV Series—Netgear)} & A5,V1 (Buffalo routers) = Bypass authentication procedures on the affected routers though files which do not need authentication and gain root level access. It enables belief service to connect other devices’ control such as IoT Devices. \\  & CVE-2021-20090 A5,V1 = V1H/9.8 \\  & CVS8.3.1/AV/N/ACL/PRN/UIN/SU/C/CH/LH/AH \\ \cline{2-3}  & A5,V2 (Cisco RV series) = Remote TA with administrative privileges inject arbitrary commands into operating system \\  & due to lack of input packet validation through web-based interface. \\  & CVE-2021-4012 A5,V2 = V2 = H/2.7 \\  & CVS8.3.1/AV/N/ACL/PRN/UIN/SU/C/CH/LH/AH \\ \cline{2-3}  & A5,V3 (Netgear router) = unauthentication TA can affect the device through buffer overflow attack. \\  & CVE-2021-224 A5,V3 = V1H/8.3 \\  & CVS8.3.1/AV/A/ACL/PRN/UIN/SU/C/CH/LH/AH \\ \hline \multirow{7}{*}{A6 = System (Windows Compatible)} & A6,V1 = A remote code execution vulnerability allows TA to execute arbitrary code and gain same right as current \\  & user. This allows to install program motifs files based on the existing user rights. \\  & CVE-2019-2136 A6,V1 = H/2 (5) \\  & CVS8.3.1/AV/N/ACL/PRN/ULR/SU/C/CH/LH/AH \\ \cline{2-3}  & A6,V2 = A remote code execution vulnerability allows TA to execute arbitrary code and gain same right as current \\  & user. TA needs control of a server to execute this vulnerability and tricks the user for to connect the server. \\  & CVE-2021-3363 A6,V2 = H/2 (5) \\  & CVS8.3.1/AV/N/ACL/PRN/UIN/SU/C/CH/LH/AH \\ \cline{2-3}  & A6,V3 = A remote code execution vulnerability allows TA to run arbitrary code with system privilege. TA could install \\  & program, amend files, and create new users with full rights. \\  & CVE-2021-3695 A6,V3 = H/2 (5) \\  & CVS8.3.1/AV/N/ACL/PRN/ULR/SU/C/CH/LH/AH \\ \hline \multirow{7}{*}{A7 = Rugged Tablet (Dell)} & A7,V1 = A local TA without the necessity of authentication can exploit this vulnerability and execute arbitrary code in \\  & system management model. \\  & CVE-2020-3548 A8,V1 = H/7.8 \\  & CVS8.3.1/AV/N/ACL/PRN/UIN/SU/C/CH/LH/AH \\ \hline \multirow{7}{*}{A8 = web-based hospital management system (Care2X)} & A8,V1 = A cross site scripting vulnerability exploited during patient registration. TA can send the XSS payload to this \\  & vulnerable parameter and take control of another register user. TA needs victim user interaction \\  & Exploitability features = Poc and Weorganized Exploit. \\  & CVE-2021-36852 A9,V1 = M5,A4 \\  & CVS8.3.1/AV/N/ACL/PRN/UIN/SU/C/CL/LH/AN \\ \hline \multirow{7}{*}{A9 = SpacoCom} & A9,V1 = Lack of authentication for critical space on function allows connection to the pump \\  & Exploitability features = Poc and Weorganized Exploit, arbitrary code execution \\  & CVE-2021-33882, A1,V1 = V1H/8.6 \\  & A9,V2 = Clear text transmission allows TA to nooop network traffic. \\  & Exploitability features = Poc and Weorganized Exploit, arbitrary code execution \\  & CVE-2021-33883, A1,V2 = H/7.5 \\  & A7,V1 = ACL/PRN/UIN/SU/C/CH/LH/AH \\ \hline \hline \end{tabular}
\end{table}