Abbott in MedDevice Cyber coverage: 5 stories, 4 products named, 4 CVEs, and the company's own disclosures.
AdvaMed's board chair says the group will treat cybersecurity like a code of ethics after Stryker, Boston Scientific, Medtronic, Abbott and Intuitive all reported attacks this year.
Abbott disclosed unauthorized access to a limited number of internal systems in its cancer diagnostics business, months after closing the $21 billion Exact Sciences acquisition. It has not said what was taken.
CISA advisory ICSMA-18-107-01 covers CVE-2017-12712 (RF authentication bypass, CVSS 7.5) and CVE-2017-12714 (battery depletion, CVSS 5.3) in Abbott ICDs and CRT-Ds distributed before April 1, 2018. A firmware update is applied through the Merlin PCS Programmer; Current and Promote cannot take it.
CISA advisory ICSMA-17-241-01 covers three flaws in Abbott Accent, Anthem, Assurity and Allure pacemakers, led by an RF authentication bypass (CVE-2017-12712, CVSS v3 7.5). A firmware update applied through the Merlin PCS Programmer adds RF wake-up protections and limits RF commands.
CISA advisory ICSMA-17-009-01A covers CVE-2017-5149 (CVSS 8.9) in St. Jude Medical Merlin@home transmitters EX1100 and EX1150: the channel to Merlin.net does not verify endpoint identities. Software version 8.2.2 fixes it and installs automatically.
Abbott products with the device attributes their own public documentation states, and the advisories in our coverage that share those attributes.
| Product | Device type | Attributes | Matched advisories |
|---|---|---|---|
| FreeStyle Libre 3 Continuous Glucose Monitoring System | Integrated Continuous Glucose Monitoring System, Factory Calibrated | 29 | 36 |
| Assert-IQ (DM5000) | Recorder, Event, Implantable Cardiac, (With Arrhythmia Detection) | 26 | 30 |
| Assert-IQ Insertable Cardiac Monitor | Recorder, Event, Implantable Cardiac, (Without Arrhythmia Detection) | 29 | 19 |
| ID NOW COVID-19 2.0 | Simple Point-Of-Care Device To Detect Sar-Cov-2 Nucleic Acid Targets From Clinical Specimens In Near-Patient Settings | 11 | 13 |
| Confirm Rx Insertable Cardiac Monitor | Recorder, Event, Implantable Cardiac, (Without Arrhythmia Detection) | 24 | 10 |
| IonicRF Generator | Generator, Lesion, Radiofrequency | 20 | 9 |
| ID Now Instrument, ID Now Influenza A & B 2, ID NOW Strep A 2 | Influenza A And Influenza B Multiplex Nucleic Acid Assay | 6 | 6 |
| FreeStyle Libre 2 Flash Glucose Monitoring System | Integrated Continuous Glucose Monitoring System, Factory Calibrated, Not For Use With Automated Insulin Delivery Systems | 18 | 5 |
| EnSite Precision Cardiac Mapping System v2.6 | Computer, Diagnostic, Programmable | 13 | 3 |
| myMerlin Mobile Application (Android) | Recorder, Event, Implantable Cardiac, (Without Arrhythmia Detection) | 17 | 3 |
| FreeStyle Libre 2 System, FreeStyle Libre 3 System | Integrated Continuous Glucose Monitoring System, Factory Calibrated, Not For Use With Automated Insulin Delivery Systems | 9 | 1 |
| Libre Rio Continuous Glucose Monitoring System | Integrated Continuous Glucose Monitor For Non-Intensive Glucose Management, Over-The-Counter | 28 | 1 |
| Assert-IQ | Recorder, Event, Implantable Cardiac, (With Arrhythmia Detection) | 12 | 0 |
| CentriMag Acute Circulatory Support System | Blood Pump For Ecmo, Long-Term (> 6 Hours) Use | 4 | 0 |
| EnSite Velocity Cardiac Mapping System | Computer, Diagnostic, Programmable | 9 | 0 |
| EnSite X EP System | Computer, Diagnostic, Programmable | 15 | 0 |
| FreeStyle Libre 2 Flash Glucose Monitoring System | Integrated Continuous Glucose Monitoring System, Factory Calibrated | 8 | 0 |
| ID NOW Influenza A & B 2 | Respiratory Virus Panel Nucleic Acid Assay System | 8 | 0 |
| Jot Dx Insertable Cardiac Monitor | Recorder, Event, Implantable Cardiac, (Without Arrhythmia Detection) | 7 | 0 |
| Medline ReNewal Reprocessed St. Jude Medical Response | Catheter, Recording, Electrode, Reprocessed | 1 | 0 |
| MitraClip G4 Steerable Guide Catheter | Catheter, Steerable | 2 | 0 |