Legacy HL7 on the clinical VLAN

Healthcare

An HL7 interface from a previous decade was still running. It was supposed to be isolated. From the clinical VLAN, it answered.

Internal network review, Hospital network, severity HIGH, reported 2025

At a glance

• Challenge. A legacy HL7 interface, documented as isolated, answered unauthenticated from the clinical VLAN and would accept clinical messages, not only serve them.
• Approach. We stood where an attacker would, a wired port in a clinical area, and enumerated what was reachable rather than what the diagram claimed.
• Result. The interface was moved behind the integration segment, the routing corrected rather than filtered and the inventory reviewed, then retested.
• Impact. From a clinical network port an unauthenticated listener would accept admissions, orders and results, so this was not only a confidentiality problem.
• Classification. CWE-306 Missing Authentication for Critical Function, MITRE ATT&CK: T1046 Network Service Discovery. Component: Legacy HL7 interface.

The challenge

HL7 predates the threat model it now lives in. The protocol was designed for a hospital basement where the network itself was the security boundary, so it carries patient data in clear text, has no authentication worth the name, and processes whatever message arrives from whatever can reach it. None of that is a defect in HL7. It is a set of preconditions, and the precondition is the segmentation.

Segmentation drifts. It drifts because a new imaging device needs a route, because two VLANs are merged during a migration, because a firewall rule written for a three-month project is never removed, and because the network diagram slowly stops describing the network and starts describing the intent. Nobody decides to expose an HL7 interface. It is exposed by the accumulation of decisions that were each reasonable on the day.

Here the interface belonged to a previous decade of the estate. It was still running because something downstream still consumed from it, and it was documented as isolated to the integration segment. From the clinical VLAN, which is the network that staff workstations and bedside devices sit on and the largest and least controlled network in the building, it answered.

The consequence is not a data leak in the ordinary sense. An unauthenticated HL7 listener accepts messages as readily as it serves them, and the messages it accepts are clinical: admissions, orders, results. That is the part of this finding that is not about confidentiality.

Our approach

We started from where an attacker would actually stand. Not at the perimeter, and not on the diagram: a wired port in a clinical area, with the access a device account has. That is the position a contractor, a compromised workstation, or anybody who can reach a patient room already occupies.

From there we mapped what was reachable rather than what was documented. That distinction is the whole method for an internal review. The diagram is a hypothesis, and the only way to test it is to enumerate from inside each segment and compare the two.

The enumeration covered:

• Every range routable from the clinical VLAN
• Every service answering on those ranges, including ones absent from the asset inventory
• Which of them required authentication and which did not
• Which of them spoke clinical protocols
• Whether each path was a route, a shared broadcast domain, or a permissive firewall rule

The interface responded. We demonstrated the reachability and the class of message it would accept, captured the evidence, and stopped there. Proving the exposure did not require sending a clinical message and it did not require reading one, so we did neither. A finding that has to touch patient data to be credible is a finding that was designed badly.

It went into the client channel with the source position, the destination, the path and the protocol banner, which was enough for the network team to reproduce it from the same port within minutes.

From finding to fix

1. Mapped the clinical network
2. Found a legacy HL7 interface reachable
3. Showed patient records exposed
4. Segmented the network, retested

The outcome

The interface was moved behind the integration segment, and the routing that let the clinical VLAN reach it was corrected rather than filtered. The route was removed, not a rule layered on top of it.

The wider change was to the inventory. An interface that nothing in the asset list accounted for had been reachable for an unknown length of time, and the review of what else was listening from that position was worth more than the single finding.

We retested from the same wired port with the same device account and confirmed it no longer answered. Reported as HIGH in 2025. Retest included in the engagement.

Check your own system

• Enumerate every service reachable from each segment and compare it against the network diagram.
• Put unauthenticated legacy protocols behind segmentation, and remove the route rather than layering a filter on it.
• Reconcile the asset inventory with what actually answers, so nothing listens unaccounted for.
• Test from where an attacker would stand, a wired port with a device account, not from the perimeter.

Read more case studies, see Network Penetration Testing, or tell us about your system on the contact page.