NP-200 system security design review
NimbusPump NP-200 Program · candidate AREV-0004 vs effective baseline DRB-0007
PRJ-2026-0042-DRV-0001Threat review
Threat workbench
Maintenance mode left enabled exposes diagnostic shell
PRJ-2026-0042-TV-000135AssessedMedium
- Proposed (passed)
- Confirmed (passed)
- Assessed (current)
- Treatment planned (pending)
- Mitigation pending (pending)
- Verified (pending)
- Closed (pending)
A device left in maintenance mode after service retains an active diagnostic shell on the serial/SSH interface. Anyone with bedside access gains elevated diagnostic capability outside a controlled service window.
Deterministic ruleConfidence medium
Actor: Opportunistic bedside actor; low skill; physical access.
- Maintenance session not closed by field service.
- No automatic timeout for OPST-003.
- Locate device still in maintenance mode.
- Attach to the exposed diagnostic session.
- Read configuration and logs; alter service settings.
Inherent
MediumL2 × I4
Residual
Not projected
Factors (1 to 5)
Exploitability2
Impact: confidentiality3
Impact: integrity4
Impact: availability2
Impact: authenticity2
Detectability3
| Category | Value | Share |
|---|---|---|
| Exploitability | 2 | 13% |
| Impact: confidentiality | 3 | 19% |
| Impact: integrity | 4 | 25% |
| Impact: availability | 2 | 13% |
| Impact: authenticity | 2 | 13% |
| Detectability | 3 | 19% |
Safety consequence: NoneScope: Single deviceUncertainty: Medium
- Exploitability
- 2/5
- Depends on a forgotten open session plus bedside presence.
- Impact: confidentiality
- 3/5
- Configuration and log data readable.
- Impact: integrity
- 4/5
- Service settings changeable with elevated shell.
- Impact: availability
- 2/5
- Device can be taken out of service.
- Impact: authenticity
- 2/5
- Actions logged under service identity.
- Safety consequence
- None
- Maintenance state excludes active infusion by interlock.
- Affected scope
- Single device
- Per-device exposure window.
- Detectability
- 3/5
- Open-session state visible on device display.
- Uncertainty
- Medium
- Frequency of open sessions in the field unmeasured (uncertainty action logged).
Medium 8 = L2 x I4; deferral decision documented (REM-216, DR-RUL-009 advisory).
- Responsible implementer
- Noor Haddad (Firmware Engineer)
- Accountable manager
- Tomas Novak
- Independent security reviewer
- Priya Raman
- Risk owner
- Marcus Chen
- Target date
- 28 Aug 2026
- Disposition
- Confirmed by Marcus Chen, 15 Apr 2026
- Treatment adopted (current)
- Implemented (pending)
- Evidence accepted (pending)
- Retest passed (pending)
- Closed (pending)
- REM-216Maintenance-mode auto-timeout with authenticated diagnosticsDeferred
EvidenceNot requestedRetestNot scheduled
- Treatment deferredTomas Novak · REM-216 deferred to release 3.3 with interim service-procedure control; due 28 Aug 2026 (DR-RUL-009 advisory).
- ConfirmedMarcus Chen
- Proposed by deterministic rule OPS-MNT-02 (run TMR-0009)system