https://meddevicecyber.com Medical Device Security Intelligence en-us Sun, 16 Aug 2026 21:08:14 GMT https://meddevicecyber.com/news/flow-neuroscience-fl-100-hardcoded-ble https://meddevicecyber.com/news/flow-neuroscience-fl-100-hardcoded-ble Thu, 13 Aug 2026 17:00:00 GMT vulnerabilities CISA advisory ICSMA-26-225-01: every Flow Neuroscience FL-100 shares one hardcoded credential, CVE-2026-18164, CVSS 8.1. An attacker in Bluetooth range can alter brain stimulation parameters. Firmware before July 2026 is affected; the fix ships through the Flow app. https://meddevicecyber.com/news/cook-medical-social-engineering https://meddevicecyber.com/news/cook-medical-social-engineering Thu, 13 Aug 2026 14:00:00 GMT threat-intel Cook Medical disclosed on August 13 that a social engineering attack on July 2 gave an outside party access to customer contact information, employee names and emails, Salesforce communication records, and internal business files. The company says it contained the access the same day and found no evidence that protected data was reached. https://meddevicecyber.com/news/chai-frontier-ai-cyber-work-group https://meddevicecyber.com/news/chai-frontier-ai-cyber-work-group Wed, 12 Aug 2026 12:00:00 GMT threat-intel The Coalition for Health AI convened a cybersecurity work group of nearly 100 members on August 12. A defensive playbook, an offensive playbook, and a frontier AI risk assessment tool are due by end of 2026. Health-ISAC and Johns Hopkins sit on the council of 14. https://meddevicecyber.com/news/pulsetto-hidden-ble-commands https://meddevicecyber.com/news/pulsetto-hidden-ble-commands Tue, 11 Aug 2026 16:15:00 GMT vulnerabilities CVE-2026-18844 rates 8.1 on CVSS v3.1. The Pulsetto vagus nerve stimulator’s firmware accepts undocumented Bluetooth Low Energy commands with no authentication, letting anyone in range disable electrical safety mechanisms or change stimulation output. Every version is affected, CISA got no answer from the vendor, and no patch exists. https://meddevicecyber.com/news/mira-hormone-monitor-cloud-auth https://meddevicecyber.com/news/mira-hormone-monitor-cloud-auth Tue, 11 Aug 2026 16:00:00 GMT vulnerabilities ICSMA-26-223-01 lists eight CVEs in the Mira Hormone Monitor and its Android app. CVE-2026-68067 (9.8) let the cloud API hand a session token to anyone holding a user’s email address, and CVE-2026-67568 (9.1) shipped hard-coded credentials inside the APK. Fixed in iOS 3.5.18, Android 4.5.18, and firmware 01.07.01.53. https://meddevicecyber.com/news/cra-reporting-deadline-september-11 https://meddevicecyber.com/news/cra-reporting-deadline-september-11 Tue, 11 Aug 2026 02:00:00 GMT fda-regulation Article 14 goes live September 11. Actively exploited vulnerability? You owe ENISA an early warning within 24 hours. MDR devices are carved out, but your companion apps and cloud services may not be. https://meddevicecyber.com/news/eu-mdr-revision-cybersecurity-gsprs https://meddevicecyber.com/news/eu-mdr-revision-cybersecurity-gsprs Tue, 11 Aug 2026 01:45:00 GMT fda-regulation Software down-classification, a well established technology pathway, and a 30 day clock on reporting exploited vulnerabilities through Eudamed. The December proposal has teeth. https://meddevicecyber.com/news/cisa-dicom-open-source-sweep https://meddevicecyber.com/news/cisa-dicom-open-source-sweep Tue, 11 Aug 2026 01:30:00 GMT vulnerabilities Four medical advisories this year hit GDCM, pydicom, OHIF and DCMTK. Not niche libraries. The imaging plumbing inside commercial products. https://meddevicecyber.com/news/philips-july-advisories-upstream-risk https://meddevicecyber.com/news/philips-july-advisories-upstream-risk Tue, 11 Aug 2026 01:15:00 GMT vulnerabilities A security vendor’s breach. A DICOM toolkit. A Windows kernel RCE. A Defender bypass. Four advisories in two months, none for a bug Philips wrote. https://meddevicecyber.com/news/top-100-disclosure-gap-desk-research https://meddevicecyber.com/news/top-100-disclosure-gap-desk-research Tue, 11 Aug 2026 01:00:00 GMT research About 25 of 110 publish real advisory listings. Thirty more post a policy page and an inbox. The rest, over 40 companies, have no public disclosure surface at all. https://meddevicecyber.com/news/radiant-heap-overflow-jpeg https://meddevicecyber.com/news/radiant-heap-overflow-jpeg Thu, 06 Aug 2026 13:00:00 GMT vulnerabilities ICSMA-26-218-01: RadiAnt DICOM 2025.2 and earlier contain a heap overflow triggered by maliciously crafted JPEG pixel data in a DICOM file, a potential path to code execution. Update to 2026.1. https://meddevicecyber.com/news/thermofisher-genetic-analyzer-integrity https://meddevicecyber.com/news/thermofisher-genetic-analyzer-integrity Tue, 04 Aug 2026 13:00:00 GMT vulnerabilities ICSMA-26-216-01: data-collection software for Applied Biosystems genetic analyzers lacked integrity checking on its output files. A proof of concept merged two DNA profiles without tripping any warning. https://meddevicecyber.com/news/stryker-backlog-into-fall https://meddevicecyber.com/news/stryker-backlog-into-fall Fri, 31 Jul 2026 19:00:00 GMT threat-intel Second-quarter revenue grew 9.4 percent, but the beds business is still digging out from the March outage and the backlog will not reach a manageable level until the end of the third quarter. https://meddevicecyber.com/news/abbott-cancer-diagnostics-breach https://meddevicecyber.com/news/abbott-cancer-diagnostics-breach Fri, 17 Jul 2026 20:00:00 GMT threat-intel Abbott disclosed unauthorized access to a limited number of internal systems in its cancer diagnostics business, months after closing the $21 billion Exact Sciences acquisition. It has not said what was taken. https://meddevicecyber.com/news/medtronic-corporate-breach-notifications https://meddevicecyber.com/news/medtronic-corporate-breach-notifications Thu, 02 Jul 2026 17:00:00 GMT threat-intel Two months after an 8-K disclosed unauthorized access to corporate IT systems, Medtronic began notifying affected people. The company reports no product, patient safety or manufacturing impact and no sign of the data online. https://meddevicecyber.com/news/cisa-dicom-stack-gdcm-pydicom-ohif-dcmtk https://meddevicecyber.com/news/cisa-dicom-stack-gdcm-pydicom-ohif-dcmtk Tue, 30 Jun 2026 14:00:00 GMT vulnerabilities GDCM, pydicom, the OHIF viewer and OFFIS DCMTK all drew medical advisories in 2026. These libraries are the imaging plumbing inside commercial products, which means the advisories are really about your SBOM. https://meddevicecyber.com/news/roche-fortibleed-response https://meddevicecyber.com/news/roche-fortibleed-response Tue, 30 Jun 2026 13:00:00 GMT threat-intel Roche published its response to the FortiBleed exposure of roughly 75,000 internet-facing Fortinet firewalls, assessing its environment and reporting no product impact. The advisory itself is the point. https://meddevicecyber.com/news/fda-mdic-pentest-validation-paper https://meddevicecyber.com/news/fda-mdic-pentest-validation-paper Mon, 29 Jun 2026 13:00:00 GMT fda-regulation FDA added an MDIC white paper on penetration-testing validation methods to its cybersecurity page, following two MITRE papers on risk analysis and SBOM data quality. Read them as scoping hints for your submission. https://meddevicecyber.com/news/irhythm-third-party-apps-extortion https://meddevicecyber.com/news/irhythm-third-party-apps-extortion Tue, 16 Jun 2026 19:30:00 GMT threat-intel A social engineering attack on third-party-hosted applications exposed patient health information and company data, followed by a payment demand. Device systems and clinical operations stayed clean. https://meddevicecyber.com/news/roche-navify-digital-pathology-default-creds https://meddevicecyber.com/news/roche-navify-digital-pathology-default-creds Fri, 29 May 2026 13:00:00 GMT vulnerabilities Roche disclosed CVE-2026-9844 in navify Digital Pathology: the bundled RabbitMQ management interface shipped with default guest credentials unless changed, opening network access to messaging and management functions. https://meddevicecyber.com/news/fourth-frontier-frontier-x-ecg-auth https://meddevicecyber.com/news/fourth-frontier-frontier-x-ecg-auth Thu, 28 May 2026 14:00:00 GMT vulnerabilities ICSMA-26-148-01: the Frontier X wearable ECG monitor and its apps allow reading and writing arbitrary handle values without authentication, CVSS 8.8, potentially altering clinical readings. https://meddevicecyber.com/news/eppendorf-bioflo-320-hardcoded-vnc https://meddevicecyber.com/news/eppendorf-bioflo-320-hardcoded-vnc Tue, 26 May 2026 14:00:00 GMT vulnerabilities ICSMA-26-146-01: the Eppendorf BioFlo 320 bioprocess controller ships a hard-coded password on its VNC remote-access interface, giving full control of the bioreactor to anyone who reaches it. https://meddevicecyber.com/news/ai-vulnerability-discovery-collapse https://meddevicecyber.com/news/ai-vulnerability-discovery-collapse Tue, 19 May 2026 13:00:00 GMT research Published CVEs hit roughly 40,000 in 2024, the largest single-year jump on record, and AI-assisted discovery is pushing the curve steeper. For device makers, the bottleneck moved from finding flaws to dispositioning them. https://meddevicecyber.com/news/baxter-abacus-transport-encryption https://meddevicecyber.com/news/baxter-abacus-transport-encryption Fri, 15 May 2026 13:00:00 GMT vulnerabilities A Baxter bulletin flagged that Abacus supports encrypted client-server communication but did not enable transport encryption by default in legacy configurations, leaving SQL traffic open to interception. https://meddevicecyber.com/news/eu-ai-act-omnibus-medical-device-delay https://meddevicecyber.com/news/eu-ai-act-omnibus-medical-device-delay Wed, 13 May 2026 13:00:00 GMT fda-regulation The Digital Omnibus agreement postpones AI Act high-risk obligations for AI embedded in medical devices from August 2027 to August 2028. The transparency duties keep their 2026 date. https://meddevicecyber.com/news/ge-revolution-ct-recall https://meddevicecyber.com/news/ge-revolution-ct-recall Mon, 11 May 2026 13:00:00 GMT vulnerabilities GE HealthCare recalled certain Revolution CT systems over a vulnerability in the AW Server deployed via its Edison Health Link subscription. About 200 systems worldwide, no breaches reported. https://meddevicecyber.com/news/mhra-draft-si-cybersecurity-pccp https://meddevicecyber.com/news/mhra-draft-si-cybersecurity-pccp Fri, 08 May 2026 13:00:00 GMT fda-regulation MHRA published the draft statutory instrument for its 2026 pre-market framework, adding explicit cybersecurity standards for software devices and a Predetermined Change Control Plan route for updates. https://meddevicecyber.com/news/stryker-q1-cost-guidance-held https://meddevicecyber.com/news/stryker-q1-cost-guidance-held Fri, 01 May 2026 20:00:00 GMT threat-intel First-quarter sales grew 2.6 percent against a March attack that wiped 40,000 laptops and stalled shipping for weeks. One analyst put the miss near $317 million. The full-year outlook did not move. https://meddevicecyber.com/news/nist-ir-8259r1-iot-manufacturers https://meddevicecyber.com/news/nist-ir-8259r1-iot-manufacturers Mon, 20 Apr 2026 13:00:00 GMT fda-regulation Final NIST IR 8259 Revision 1 restructures foundational cybersecurity activities across pre-market and post-market phases and expands what manufacturers must tell customers about support and end of life. https://meddevicecyber.com/news/orthanc-dicom-server-nine-cves https://meddevicecyber.com/news/orthanc-dicom-server-nine-cves Thu, 09 Apr 2026 14:00:00 GMT vulnerabilities CERT/CC VU#536588: nine flaws in the Orthanc open-source DICOM server through 1.12.10, including heap overflows in the image decoder rated up to critical and decompression-bomb memory exhaustion. https://meddevicecyber.com/news/fbi-ic3-2025-healthcare-most-attacked https://meddevicecyber.com/news/fbi-ic3-2025-healthcare-most-attacked Wed, 08 Apr 2026 13:00:00 GMT threat-intel The FBI IC3 2025 report recorded 278 ransomware complaints from healthcare, the most of any critical infrastructure sector, and flagged a troubling uptick in AI-enabled cybercrime. https://meddevicecyber.com/news/forescout-2026-riskiest-connected-devices https://meddevicecyber.com/news/forescout-2026-riskiest-connected-devices Mon, 23 Mar 2026 14:00:00 GMT threat-intel Forescout's 2026 Riskiest Connected Devices report added medication dispensing systems, medical image printers and DICOM gateways, and found healthcare has the highest prevalence of legacy Windows of any sector. https://meddevicecyber.com/news/stryker-intune-wiper-attack https://meddevicecyber.com/news/stryker-intune-wiper-attack Thu, 19 Mar 2026 13:30:00 GMT threat-intel Stryker identified a cyberattack on March 11. Researchers say the attacker used admin access to Microsoft Intune to push wipe commands across phones and workstations, and CISA wants every operator to harden that layer now. https://meddevicecyber.com/news/ge-centricity-universal-viewer-recall https://meddevicecyber.com/news/ge-centricity-universal-viewer-recall Mon, 16 Mar 2026 14:00:00 GMT vulnerabilities GE HealthCare issued an urgent correction for Centricity Universal Viewer after a flaw exposed user login credentials on the local client. An attacker with physical access could harvest them. FDA logged it as a Class 2 recall. https://meddevicecyber.com/news/intuitive-surgical-phishing-incident https://meddevicecyber.com/news/intuitive-surgical-phishing-incident Fri, 13 Mar 2026 22:00:00 GMT threat-intel Intuitive Surgical said an unauthorized third party got at customer business and contact information along with employee and corporate data after a phishing incident. https://meddevicecyber.com/news/ufp-technologies-cyberattack-delays https://meddevicecyber.com/news/ufp-technologies-cyberattack-delays Fri, 27 Feb 2026 15:00:00 GMT threat-intel UFP Technologies, which makes components and finished devices for medtech OEMs, is investigating a cyberattack that touched company data and warned of short-term shipment delays. https://meddevicecyber.com/news/siemens-syngo-plaza-weak-password https://meddevicecyber.com/news/siemens-syngo-plaza-weak-password Tue, 10 Feb 2026 14:00:00 GMT vulnerabilities Siemens Healthineers SSA-016040: syngo.plaza VB30E stored passwords with weak encoding, letting an attacker recover the originals and gain unauthorized access. Fixed in VB30E_HF07. https://meddevicecyber.com/news/zoll-epcr-ios-script-injection https://meddevicecyber.com/news/zoll-epcr-ios-script-injection Tue, 10 Feb 2026 14:00:00 GMT vulnerabilities ICSMA-26-041-01: the ZOLL ePCR iOS app reflected unsanitized field input into a WebView, opening script injection that could expose PHI captured in the field. https://meddevicecyber.com/news/health-isac-2026-annual-threat-report https://meddevicecyber.com/news/health-isac-2026-annual-threat-report Mon, 26 Jan 2026 14:00:00 GMT threat-intel Health-ISAC counted 455 ransomware incidents against healthcare in 2025, named Qilin, INC Ransom and SafePay among the most active, and reported executives rank AI-enabled attacks as the top emerging concern. https://meddevicecyber.com/news/ecri-ai-chatbots-top-hazard-2026 https://meddevicecyber.com/news/ecri-ai-chatbots-top-hazard-2026 Wed, 21 Jan 2026 14:00:00 GMT research ECRI's annual hazard list put misuse of AI chatbots at number one for 2026 and legacy medical device cybersecurity at number eight, tying both directly to patient harm. https://meddevicecyber.com/news/whill-power-wheelchair-ble-takeover https://meddevicecyber.com/news/whill-power-wheelchair-ble-takeover Tue, 30 Dec 2025 14:00:00 GMT vulnerabilities ICSMA-25-364-01: WHILL Model C2 and Model F powered chairs accepted Bluetooth control without authentication, CVSS 9.8. An attacker in range could stop or steer the chair. https://meddevicecyber.com/news/jama-llm-prompt-injection-clinical https://meddevicecyber.com/news/jama-llm-prompt-injection-clinical Fri, 19 Dec 2025 14:00:00 GMT research A JAMA Network Open study found commercial large language models showed substantial vulnerability to prompt injection that pushed them into clinically dangerous medication and treatment recommendations. https://meddevicecyber.com/news/eu-mdr-revision-cyber-gsprs-reporting https://meddevicecyber.com/news/eu-mdr-revision-cyber-gsprs-reporting Wed, 17 Dec 2025 14:00:00 GMT fda-regulation The December 2025 MDR/IVDR revision proposal writes cybersecurity into the GSPRs and adds Articles 87a/82a requiring manufacturers to report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA. https://meddevicecyber.com/news/varex-panoramic-dental-dll-hijack https://meddevicecyber.com/news/varex-panoramic-dental-dll-hijack Thu, 11 Dec 2025 14:00:00 GMT vulnerabilities ICSMA-25-345-02: an uncontrolled search path in Varex/Panoramic dental imaging software lets a standard user escalate to SYSTEM through the ccsservice.exe component. https://meddevicecyber.com/news/germany-nis2-in-force-manufacturers https://meddevicecyber.com/news/germany-nis2-in-force-manufacturers Tue, 09 Dec 2025 14:00:00 GMT fda-regulation The German NIS2 implementation law entered into force in December 2025 with immediate effect. Medical device manufacturing is a NIS2 sector, so larger makers with German operations became important entities overnight. https://meddevicecyber.com/news/cra-implementing-regulation-2392-classification https://meddevicecyber.com/news/cra-implementing-regulation-2392-classification Thu, 04 Dec 2025 14:00:00 GMT fda-regulation Implementing Regulation (EU) 2025/2392 fixed the technical descriptions of important and critical products under the Cyber Resilience Act, including health-adjacent categories like wellness wearables. https://meddevicecyber.com/news/medtronic-carelink-network-enumeration https://meddevicecyber.com/news/medtronic-carelink-network-enumeration Thu, 04 Dec 2025 14:00:00 GMT vulnerabilities Medtronic disclosed four flaws in the CareLink Network web layer, including observable-response user enumeration, after researchers probed a non-production instance at a security conference. Patched, no patient harm. https://meddevicecyber.com/news/mirion-ec2-hardcoded-credentials https://meddevicecyber.com/news/mirion-ec2-hardcoded-credentials Tue, 02 Dec 2025 14:00:00 GMT vulnerabilities ICSMA-25-336-01: five high-severity flaws in Mirion Medical EC2 software (NMIS, BioDose), including hard-coded credentials and authentication enforced on the client. https://meddevicecyber.com/news/akira-ransomware-244-million-healthcare https://meddevicecyber.com/news/akira-ransomware-244-million-healthcare Fri, 14 Nov 2025 14:00:00 GMT threat-intel An updated FBI and CISA advisory put Akira ransomware proceeds past $244 million since 2023, detailing VPN logins without MFA and encryption of VMware ESXi and Nutanix virtual machines. https://meddevicecyber.com/news/vertikal-hospital-manager-info-disclosure https://meddevicecyber.com/news/vertikal-hospital-manager-info-disclosure Tue, 28 Oct 2025 13:00:00 GMT vulnerabilities ICSMA-25-301-01: Vertikal Systems Hospital Manager backend exposed sensitive system information to unauthorized users and returned error messages stuffed with more of it. https://meddevicecyber.com/news/nihon-kohden-cns-6201-dos https://meddevicecyber.com/news/nihon-kohden-cns-6201-dos Thu, 23 Oct 2025 13:00:00 GMT vulnerabilities ICSMA-25-296-01: Nihon Kohden CNS-6201 central monitoring stations can be pushed into a denial of service, CVSS 7.5. The station is the screen that aggregates bedside vitals. https://meddevicecyber.com/news/oxford-nanopore-minknow-missing-auth https://meddevicecyber.com/news/oxford-nanopore-minknow-missing-auth Tue, 21 Oct 2025 13:00:00 GMT vulnerabilities ICSMA-25-294-01: the MinKNOW software that drives Oxford Nanopore sequencers shipped with missing authentication for a critical function, CVSS 8.6, plus weakly protected credentials. https://meddevicecyber.com/news/f5-emergency-directive-hospitals https://meddevicecyber.com/news/f5-emergency-directive-hospitals Thu, 16 Oct 2025 13:00:00 GMT threat-intel CISA issued Emergency Directive 26-01 after F5 disclosed a nation-state actor had stolen BIG-IP source code and undisclosed vulnerability data. The AHA told hospitals to act, calling the gear ubiquitous in healthcare. https://meddevicecyber.com/news/jnj-impella-controller-cyber-recall https://meddevicecyber.com/news/jnj-impella-controller-cyber-recall Tue, 14 Oct 2025 14:30:00 GMT vulnerabilities Vulnerabilities in the Automated Impella Controller’s operating system could allow loss of device control or an unexpected pump stop. FDA classified the action Class I on potential harm alone. https://meddevicecyber.com/news/tga-cybersecurity-guidance-update-2025 https://meddevicecyber.com/news/tga-cybersecurity-guidance-update-2025 Mon, 06 Oct 2025 13:00:00 GMT fda-regulation The TGA updated its medical device cybersecurity guidance in October 2025, tying it to Essential Principle 12 and expecting manufacturers to maintain an SBOM and total-product-lifecycle monitoring. https://meddevicecyber.com/news/imdrf-sapporo-cybersecurity-work-item https://meddevicecyber.com/news/imdrf-sapporo-cybersecurity-work-item Mon, 22 Sep 2025 13:00:00 GMT fda-regulation The September 2025 IMDRF Management Committee approved a new work item on cybersecurity controls and testing considerations, the kind of document FDA, PMDA, TGA and EU regulators fold into converging expectations. https://meddevicecyber.com/news/anthropic-vibe-hacking-healthcare-extortion https://meddevicecyber.com/news/anthropic-vibe-hacking-healthcare-extortion Wed, 27 Aug 2025 13:00:00 GMT threat-intel Anthropic disclosed an operation where an attacker used an AI coding agent to automate reconnaissance, intrusion, data theft and ransom notes against at least 17 organizations, including healthcare. https://meddevicecyber.com/news/fujifilm-synapse-mobility-parameter-tampering https://meddevicecyber.com/news/fujifilm-synapse-mobility-parameter-tampering Thu, 21 Aug 2025 13:00:00 GMT vulnerabilities ICSMA-25-233-01: FUJIFILM Synapse Mobility lets an authenticated low-privilege user manipulate a web search parameter to reach imaging and patient data beyond their assigned role. https://meddevicecyber.com/news/fda-final-premarket-cybersecurity-guidance-2025 https://meddevicecyber.com/news/fda-final-premarket-cybersecurity-guidance-2025 Mon, 18 Aug 2025 13:00:00 GMT fda-regulation The June 2025 final guidance adds a section built around Section 524B: secure development evidence, a machine-readable SBOM, and a postmarket vulnerability plan, all expected in the submission itself. https://meddevicecyber.com/news/santesoft-sante-pacs-five-flaws https://meddevicecyber.com/news/santesoft-sante-pacs-five-flaws Tue, 12 Aug 2025 13:00:00 GMT vulnerabilities ICSMA-25-224-01 covers five bugs in Santesoft Sante PACS Server before 4.2.3, including a double free that crashes the archive on a crafted HL7 message and a web portal that transmits credentials in the clear. https://meddevicecyber.com/news/modat-1-2-million-exposed-devices https://meddevicecyber.com/news/modat-1-2-million-exposed-devices Thu, 07 Aug 2025 13:00:00 GMT threat-intel Modat, working with Health-ISAC and Z-CERT, found over 1.2 million internet-connected healthcare devices exposed online. Some served live MRI and chest images tagged with patient names. https://meddevicecyber.com/news/illumina-doj-false-claims-settlement https://meddevicecyber.com/news/illumina-doj-false-claims-settlement Fri, 01 Aug 2025 16:00:00 GMT fda-regulation Illumina settled DOJ allegations that it sold genomic sequencers with vulnerable software to federal agencies while lacking an adequate security program from 2016 to 2023. A former insider brought the case and takes $1.9 million. https://meddevicecyber.com/news/medtronic-mycarelink-monitor-flaws https://meddevicecyber.com/news/medtronic-mycarelink-monitor-flaws Thu, 24 Jul 2025 13:00:00 GMT vulnerabilities ICSMA-25-205-01: the Medtronic MyCareLink monitor stored data unencrypted, shipped a built-in account with an empty password, and deserialized untrusted data. Physical access required, no evidence of exploitation. https://meddevicecyber.com/news/panoramic-digital-imaging-dll-hijack https://meddevicecyber.com/news/panoramic-digital-imaging-dll-hijack Thu, 17 Jul 2025 13:00:00 GMT vulnerabilities ICSMA-25-198-01: Panoramic Digital Imaging Software was vulnerable to DLL hijacking inherited from an unsupported third-party SDK, letting a standard user escalate to SYSTEM. https://meddevicecyber.com/news/roche-navify-monitoring-api-dos https://meddevicecyber.com/news/roche-navify-monitoring-api-dos Thu, 17 Jul 2025 13:00:00 GMT vulnerabilities Roche disclosed CVE-2025-7674 in navify Monitoring: an API lacked adequate input validation, so crafted or excessive data could be processed unsafely and knock the service over. Fixed before 1.08.00. https://meddevicecyber.com/news/microdicom-viewer-repeated-oob https://meddevicecyber.com/news/microdicom-viewer-repeated-oob Tue, 10 Jun 2025 14:00:00 GMT vulnerabilities ICSMA-25-121-01 and ICSMA-25-160-01: MicroDicom DICOM Viewer took out-of-bounds write and read findings a month apart, both reachable by opening a crafted DICOM file, both around CVSS 8.8. https://meddevicecyber.com/news/ge-muse-legacy-recall https://meddevicecyber.com/news/ge-muse-legacy-recall Tue, 10 Jun 2025 13:00:00 GMT vulnerabilities GE HealthCare recalled legacy MUSE cardiology systems after finding an outside party could view and manipulate stored patient data. About 4,200 systems, some out of service support since 2014. https://meddevicecyber.com/news/masimo-shipped-through-cyberattack https://meddevicecyber.com/news/masimo-shipped-through-cyberattack Thu, 29 May 2025 17:00:00 GMT threat-intel The patient monitoring company said the attack that hit its ability to fulfill orders will not stop fulfillment going forward and will not move its updated outlook. https://meddevicecyber.com/news/infinitt-pacs-file-upload-rce https://meddevicecyber.com/news/infinitt-pacs-file-upload-rce Thu, 10 Apr 2025 14:00:00 GMT vulnerabilities ICSMA-25-100-01: INFINITT PACS System Manager had two unrestricted file-upload flaws toward remote code execution plus an information-exposure bug, on the server that holds the imaging archive. https://meddevicecyber.com/news/philips-intellispace-portal-net-remoting https://meddevicecyber.com/news/philips-intellispace-portal-net-remoting Thu, 10 Apr 2025 13:00:00 GMT vulnerabilities Philips flagged deserialization of untrusted data in IntelliSpace Portal and Advanced Visualization Workspace: .NET Remoting on TCP 755 with TypeFilterLevel set to Full, a path to remote code execution. https://meddevicecyber.com/news/santesoft-dicom-viewer-oob https://meddevicecyber.com/news/santesoft-dicom-viewer-oob Thu, 20 Mar 2025 14:00:00 GMT vulnerabilities CISA hit Sante DICOM Viewer Pro twice in 2025: an out-of-bounds write (ICSMA-25-079-01) and later an out-of-bounds read (ICSMA-25-148-01), both triggered by opening a crafted file. https://meddevicecyber.com/news/philips-iscv-hardcoded-aes-key https://meddevicecyber.com/news/philips-iscv-hardcoded-aes-key Thu, 13 Mar 2025 14:00:00 GMT vulnerabilities ICSMA-25-072-01: Philips IntelliSpace Cardiovascular built its auth tokens on a fixed AES-128 key identical across all installations, and let the login token be replayed to bypass authentication. https://meddevicecyber.com/news/philips-dicom-viewer-malware-impersonation https://meddevicecyber.com/news/philips-dicom-viewer-malware-impersonation Wed, 26 Feb 2025 14:00:00 GMT threat-intel Philips warned that malware is circulating impersonating its legitimate DICOM Viewer software. Not a product flaw, a brand-impersonation threat that turns your download page into an attacker channel. https://meddevicecyber.com/news/medixant-radiant-update-tls https://meddevicecyber.com/news/medixant-radiant-update-tls Thu, 20 Feb 2025 14:00:00 GMT vulnerabilities ICSMA-25-051-01: RadiAnt DICOM Viewer failed to verify the update server TLS certificate, giving a man-in-the-middle attacker a path to deliver a malicious update. https://meddevicecyber.com/news/orthanc-server-default-no-auth https://meddevicecyber.com/news/orthanc-server-default-no-auth Thu, 06 Feb 2025 14:00:00 GMT vulnerabilities ICSMA-25-037-02: Orthanc Server before 1.5.8 did not enable authentication by default when the HTTP interface was exposed, leaving imaging records reachable to any unauthenticated attacker. https://meddevicecyber.com/news/contec-cms8000-backdoor https://meddevicecyber.com/news/contec-cms8000-backdoor Thu, 30 Jan 2025 14:00:00 GMT vulnerabilities ICSMA-25-030-01: the Contec CMS8000 monitor firmware beacons to a hard-coded IP and can pull and run files. CISA and FDA issued companion backdoor fact sheets, and the same firmware sits in relabeled monitors. https://meddevicecyber.com/news/bd-warning-letter-software-defects https://meddevicecyber.com/news/bd-warning-letter-software-defects Fri, 20 Dec 2024 15:30:00 GMT fda-regulation A warning letter over quality system violations flagged open tickets for software defects categorized as catastrophic or severe patient harm, plus safety complaints reported late. https://meddevicecyber.com/news/bd-diagnostic-solutions-default-creds https://meddevicecyber.com/news/bd-diagnostic-solutions-default-creds Tue, 17 Dec 2024 14:00:00 GMT vulnerabilities ICSMA-24-352-01: BD Diagnostic Solutions instruments including BACTEC and Phoenix shipped with default credentials, letting an attacker with network access read, modify or delete data including PHI. https://meddevicecyber.com/news/siemens-syngo-plaza-sql-injection https://meddevicecyber.com/news/siemens-syngo-plaza-sql-injection Fri, 06 Dec 2024 14:00:00 GMT vulnerabilities Siemens Healthineers SHSA-160244: syngo.plaza VB30E failed to sanitize input before the SQL server, letting an unauthenticated network attacker run arbitrary SQL and compromise the whole database. https://meddevicecyber.com/news/baxter-life2000-ventilator-flaws https://meddevicecyber.com/news/baxter-life2000-ventilator-flaws Thu, 14 Nov 2024 14:00:00 GMT vulnerabilities ICSMA-24-319-01: Baxter Life2000 Ventilation System carried nine CVEs, two rated a maximum 10.0, spanning hard-coded credentials, cleartext transmission, an exposed JTAG interface and missing authentication. https://meddevicecyber.com/news/fda-legacy-devices-work-in-progress https://meddevicecyber.com/news/fda-legacy-devices-work-in-progress Thu, 17 Oct 2024 18:00:00 GMT fda-regulation At The Medtech Conference, FDA’s Suzanne Schwartz called legacy device cybersecurity a work in progress and a problem regulators and industry have to solve together. https://meddevicecyber.com/news/baxter-connex-health-portal-sqli https://meddevicecyber.com/news/baxter-connex-health-portal-sqli Thu, 05 Sep 2024 13:00:00 GMT vulnerabilities ICSMA-24-249-01: the Baxter Connex Health Portal had a critical unauthenticated SQL injection, base score 10.0, letting a remote attacker run arbitrary SQL, plus an access-control flaw exposing patient and clinician data.