The Patching Friars' AlmanacA calendar of CVE saints

Patron of April 12

JekyllBot:5Holy card for jekyllbot-5, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 JekyllBot:5 DUAE ANIMAE
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint JekyllBot:5, the Robot With a Double Life

Patron of hospital robots, control servers left on the internet, and machines that deliver medicine without asking questions.

Life

On 12 April 2022 Cynerio revealed five vulnerabilities in Aethon's TUG autonomous robots, which carry medicine, linen and meals around hospitals. The server that runs them could be reached without authentication: a stranger could have taken control, watched through their cameras or disrupted their rounds. Helpful Dr Jekyll by day, potentially Mr Hyde by night: Aethon fixed it all in version 24 of the Home Base Server.

Prayer

O Saint JekyllBot, who walks the wards with two souls, let our robots answer only to those who care for them. Amen.

How to celebrate

Celebrated by updating the Home Base Server and taking off the internet anything with wheels and a web interface.

A faithful robot by day, but who drives it by night?

Technical record

Disclosed on
April 12 2022
CVE
CVE-2022-1066CVE-2022-26423CVE-2022-1070CVE-2022-27494CVE-2022-1059
CVSS
8.2
Product
Aethon · TUG Home Base Server

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.

Sources: cynerio.com · web.archive.org

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.