LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Siemens Healthineers // Products

MOBILETT Impact

System, X-Ray, Mobile. Attributes come from Siemens Healthineers's own public documentation for this product.

Attributes

Signals
Role-based access User accounts Handles patient data Wireless connectivity Hospital network
Properties (MITRE EMB3D)
PID-2322 Device deploys an access enforcement/privilege mechanism PID-28 Device stores logs of system events and information PID-31 Application-level software is present and running on the device PID-33 Device includes interactive applications, services, or user interfaces PID-332 Device includes authenticated services PID-34 Device stores logs of application events and information PID-41 Device exposes remote network services PID-4113 Device includes cryptographic functions for sensitive data, such as encryption or authentication
Attributes: component types
Battery Display Generic Application Library Local Application Local Service Operating System User Interface
Attributes: interface types
Wireless
Attributes: assets
Log Data Patient Data User Data
Attributes: dataflows
MOBILETT Impact to hospital systems (images, wireless)

Matched threat intel

42

Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what Siemens Healthineers has said.

AdvisoryDateSharedSiemens Healthineers status
Flow Neuroscience FL-100 ships a shared Bluetooth credential in every unitAug 13, 2026Same property (MITRE EMB3D)PID-411No feedback feed from manufacturer
Mira’s cloud login accepted any password and returned a session tokenAug 11, 2026Same property (MITRE EMB3D)PID-411No feedback feed from manufacturer
Missing authentication lets an attacker rewrite a cardiac wearableMay 28, 2026Same property (MITRE EMB3D)PID-411No feedback feed from manufacturer
A hard-coded VNC password on a bioreactor, base score 9.8May 26, 2026Same property (MITRE EMB3D)PID-332No feedback feed from manufacturer
Compounding software that did not encrypt its database traffic by defaultMay 15, 2026Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Login credentials exposed on the workstation in a GE imaging viewerMar 16, 2026Same property (MITRE EMB3D)PID-332No feedback feed from manufacturer
Missing authentication on a DNA sequencer control planeOct 21, 2025Same property (MITRE EMB3D)PID-332No feedback feed from manufacturer
A low-privilege user can walk past role limits in Synapse MobilityAug 21, 2025Same property (MITRE EMB3D)PID-2322No feedback feed from manufacturer
Baxter Welch Allyn Connex Spot Monitor used a default cryptographic keyMay 30, 2024Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Fresenius lists Conox anesthesia monitor as affected by BLUFFS Bluetooth flawApr 10, 2024Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
BD Synapsys sessions did not expire, risking changes to patient dataMay 31, 2022Same property (MITRE EMB3D)PID-332No feedback feed from manufacturer
Philips PIC iX and Efficia CM Series carry a hard-coded key and weak cryptoNov 18, 2021Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Philips IntelliVue monitors and PIC iX skip certificate revocation and crash on bad inputSep 10, 2020Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Philips DreamMapper 2.24 and earlier write attacker-useful details to log filesJul 30, 2020Same property (MITRE EMB3D)PID-34No feedback feed from manufacturer
BIOTRONIK CardioMessenger II-S home monitors store recoverable credentials and leak them in cleartextJun 18, 2020Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Philips IntelliBridge Enterprise writes plaintext EMR credentials into its transaction logsJun 11, 2020Same property (MITRE EMB3D)PID-34No feedback feed from manufacturer
Philips IntelliBridge EC40 and EC80 hubs allow weak SSH ciphersNov 14, 2019Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Philips HealthSuite Health Android app uses encryption too weak for its dataDec 6, 2018Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Medtronic MyCareLink 24950 and 24952 monitors store upload credentials in a recoverable formatAug 7, 2018Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Hard-coded credentials and client-side auth in nuclear-medicine softwareDec 2, 2025Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
Empty passwords and cleartext storage in a home cardiac monitorJul 24, 2025Exposed to the same EMB3D threatTID-328No feedback feed from manufacturer
Default credentials across a line of diagnostic instrumentsDec 17, 2024Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
Philips Vue PACS before 12.2.8.410 ships a default database password and can be overloadedJul 18, 2024Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
BD Alaris Infusion Central leaves a recoverable database password after installationFeb 16, 2023Exposed to the same EMB3D threatTID-221No feedback feed from manufacturer
Hillrom Welch Allyn ELI resting electrocardiographs contain hard-coded passwordsJun 16, 2022Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
BD Pyxis products may still run on shared default operating system credentialsMay 31, 2022Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
BD Viper LT system uses hard-coded credentials that expose patient dataMar 3, 2022Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
BD Pyxis dispensing and supply systems ship with hard-coded credentials across 24 productsMar 3, 2022Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
Swisslog Translogic Nexus Control Panel ships hard-coded root passwords and unvalidated updatesAug 3, 2021Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
Baxter PrismaFlex and PrisMax send treatment data to EMR systems without encryption or authenticationJun 18, 2020Exposed to the same EMB3D threatTID-411No feedback feed from manufacturer
Baxter Phoenix hemodialysis system sends treatment and prescription data in cleartextJun 18, 2020Exposed to the same EMB3D threatTID-411No feedback feed from manufacturer
Medtronic CareLink 9790, 2090 and Encore 29901 programmers store patient data unencryptedDec 13, 2018Exposed to the same EMB3D threatTID-221No feedback feed from manufacturer
Philips iSite and IntelliSpace PACS carry default credentials in third-party softwareNov 8, 2018Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
Roche Accu-Chek and CoaguChek point of care handhelds expose a weakly protected service interfaceNov 6, 2018Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer
Philips PageWriter TC cardiographs expose a hard-coded superuser password and unchecked inputAug 16, 2018Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
Philips Alice 6 through R8.0.3 lacks authentication and encryption between nodesMar 27, 2018Exposed to the same EMB3D threatTID-411No feedback feed from manufacturer
Philips IntelliSpace Cardiovascular and Xcelera store credentials in cleartextNov 14, 2017Exposed to the same EMB3D threatTID-221No feedback feed from manufacturer
Smiths Medical Medfusion 4000 syringe pump ships hard-coded wireless, FTP and Telnet credentialsSep 7, 2017Exposed to the same EMB3D threatTID-316No feedback feed from manufacturer
Philips DoseWise Portal hard-codes its database credentials and stores logins in clear textAug 17, 2017Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
BD Kiestra PerformA and KLA Journal Service use a hard-coded database passwordMar 23, 2017Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
BD Alaris 8000 PC unit stores wireless network credentials unencrypted in flash memoryJan 17, 2017Exposed to the same EMB3D threatTID-221No feedback feed from manufacturer
Animas OneTouch Ping insulin pump accepts replayed and unencrypted radio commandsOct 5, 2016Exposed to the same EMB3D threatTID-221No feedback feed from manufacturer

Threats and weaknesses in matched advisories

MITRE EMB3D threats
TID-108 ROM/NVRAM Data Extraction or Modification TID-111 Untrusted External Storage TID-204 Untrusted Programs Can Access Privileged OS Functions TID-205 Existing OS Tools Maliciously Used for Device Manipulation TID-211 Device Allows Unauthenticated Firmware Installation TID-213 Faulty FW/SW Update Integrity Verification TID-219 OS/Kernel Privilege Escalation TID-221 Authentication Bypass By Message Replay TID-222 Critical System Service May Be Disabled TID-226 Device leaks security information in logs TID-301 Applications Binaries Modified TID-303 Excessive Trust in Offboard Management/IDE Software TID-310 Remotely Accessible Unauthenticated Services TID-311 Default Credentials TID-313 Unauthenticated Session Changes Credential TID-314 Passwords Can Be Guessed Using Brute-Force Attempts TID-316 Incorrect Certificate Verification Allows Authentication Bypass TID-317 Predictable Cryptographic Key TID-318 Insecure Cryptographic Implementation TID-319 Cross Site Scripting (XSS) TID-324 HTTP Direct Object Reference TID-326 Insecure Deserialization TID-327 Out of Bounds Memory Access TID-328 Hardcoded Credentials TID-329 Improper Password Storage TID-401 Undocumented Protocol Features TID-404 Remotely Triggerable Deadlock/DoS TID-405 Network Stack Resource Exhaustion TID-406 Unauthorized Messages or Connections TID-407 Missing Message Replay Protection TID-408 Unencrypted Sensitive Data Communication TID-411 Weak/Insecure Cryptographic Protocol
CWE weaknesses
CWE-1188 Insecure Default Initialization of Resource CWE-1390 Weak Authentication CWE-1392 Use of Default Credentials CWE-20 Improper Input Validation CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-276 Incorrect Default Permissions CWE-284 Improper Access Control CWE-287 Improper Authentication CWE-290 Authentication Bypass by Spoofing CWE-294 Authentication Bypass by Capture-replay CWE-306 Missing Authentication for Critical Function CWE-319 Cleartext Transmission of Sensitive Information CWE-321 Use of Hard-coded Cryptographic Key CWE-326 Inadequate Encryption Strength CWE-400 Uncontrolled Resource Consumption CWE-427 Uncontrolled Search Path Element CWE-476 NULL Pointer Dereference CWE-502 Deserialization of Untrusted Data CWE-522 Insufficiently Protected Credentials CWE-639 Authorization Bypass Through User-Controlled Key CWE-798 Use of Hard-coded Credentials CWE-916 Use of Password Hash With Insufficient Computational Effort