LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Olympus // Products

Visera S Video System Center Olympus OTV-S500

Nasopharyngoscope (Flexible Or Rigid). Attributes come from Olympus's own public documentation for this product.

Attributes

Signals
USB port Field-updatable firmware
Properties (MITRE EMB3D)
PID-11 Device includes a microprocessor PID-14 Device includes external peripheral interconnects (e.g., USB, Serial) PID-27 Device includes support for firmware/software updates PID-31 Application-level software is present and running on the device PID-33 Device includes interactive applications, services, or user interfaces
Attributes: component types
CPU Circuit Board Display Firmware Generic Application Local Application User Interface
Attributes: interface types
USB Wireless

Matched threat intel

11

Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what Olympus has said.

AdvisoryDateSharedOlympus status
A DICOM viewer that did not check its update server certificateFeb 20, 2025Same property (MITRE EMB3D)PID-27No feedback feed from manufacturer
MicroDicom DICOM Viewer 2024.03 fails to validate its update server certificateFeb 6, 2025Same property (MITRE EMB3D)PID-27No feedback feed from manufacturer
A patient monitor with a hidden backdoor that phones homeJan 30, 2025Same property (MITRE EMB3D)PID-27No feedback feed from manufacturer
Two maximum-severity flaws in a ventilation systemNov 14, 2024Same property (MITRE EMB3D)PID-14No feedback feed from manufacturer
Boston Scientific ZOOM LATITUDE PRM Model 3120 accepts unsigned software from USB and can be re-regionedSep 30, 2021Same property (MITRE EMB3D)PID-14No feedback feed from manufacturer
Capsule Technologies SmartLinx Neuron 2 kiosk escapes to admin with a USB keyboardJul 14, 2020Same property (MITRE EMB3D)PID-14No feedback feed from manufacturer
GE Aestiva and Aespire anesthesia devices can have alarms silenced through unsecured terminal serversJul 9, 2019Same property (MITRE EMB3D)PID-14No feedback feed from manufacturer
Medtronic 2090 CareLink and 29901 Encore programmers accept updates without verifying their originFeb 27, 2018Same property (MITRE EMB3D)PID-27No feedback feed from manufacturer
Canon Medical holds off on Meltdown and Spectre patches for its diagnostic imaging equipmentJan 15, 2018Same property (MITRE EMB3D)PID-11No feedback feed from manufacturer
Cepheid GeneXpert Xpress 6.4a ships without Windows speculative execution mitigationsMar 11, 2026Exposed to the same EMB3D threatTID-103No feedback feed from manufacturer
Empty passwords and cleartext storage in a home cardiac monitorJul 24, 2025Exposed to the same EMB3D threatTID-111No feedback feed from manufacturer

Threats and weaknesses in matched advisories

MITRE EMB3D threats
TID-103 Microarchitectural Side Channels TID-111 Untrusted External Storage TID-115 Firmware/Data Extraction via Hardware Interface TID-116 Latent Privileged Access Port TID-119 Latent Hardware Debug Port Allows Memory/Code Manipulation TID-204 Untrusted Programs Can Access Privileged OS Functions TID-205 Existing OS Tools Maliciously Used for Device Manipulation TID-210 Device Vulnerabilities Unpatchable TID-211 Device Allows Unauthenticated Firmware Installation TID-213 Faulty FW/SW Update Integrity Verification TID-215 Unencrypted SW/FW Updates TID-219 OS/Kernel Privilege Escalation TID-222 Critical System Service May Be Disabled TID-224 Excessive Access via Software Diagnostic Features TID-310 Remotely Accessible Unauthenticated Services TID-311 Default Credentials TID-314 Passwords Can Be Guessed Using Brute-Force Attempts TID-316 Incorrect Certificate Verification Allows Authentication Bypass TID-323 Path Traversal TID-326 Insecure Deserialization TID-327 Out of Bounds Memory Access TID-328 Hardcoded Credentials TID-329 Improper Password Storage TID-401 Undocumented Protocol Features TID-406 Unauthorized Messages or Connections TID-408 Unencrypted Sensitive Data Communication
CWE weaknesses
CWE-1104 Use of Unmaintained Third Party Components CWE-1188 Insecure Default Initialization of Resource CWE-1191 On-Chip Debug and Test Interface With Improper Access Control CWE-1313 Hardware Allows Activation of Test or Debug Logic at Runtime CWE-1329 Reliance on Component That is Not Updateable CWE-276 Incorrect Default Permissions CWE-345 Insufficient Verification of Data Authenticity CWE-427 Uncontrolled Search Path Element CWE-494 Download of Code Without Integrity Check CWE-502 Deserialization of Untrusted Data CWE-506 Embedded Malicious Code CWE-522 Insufficiently Protected Credentials CWE-912 Hidden Functionality