LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

B. Braun OnlineSuite AP 3.0 flaws allow remote code execution with highest privileges

MedDevice Cyber Staff · Jun 6 · 3 min read · Via B. Braun OnlineSuite statement, June 2025

B. Braun published a statement on June 6, 2025, on CVE-2025-3321, CVE-2025-3322 and CVE-2025-3365 in OnlineSuite AP 3.0 and earlier, including installs with the FSI-06-2020 patch. CODE WHITE GmbH reported the flaws.

The weaknesses are expression language injection, relative path traversal and hard-coded credentials. Combined, they may allow privilege escalation, arbitrary file upload and download, and remote code execution with highest privileges. B. Braun scores the issue at CVSS 10.0.

The patch ships as FSI 14-25, OnlineSuite AP3.0 Security Fix.

Hard-coded credentials in a server that talks to infusion pumps are a design debt, and the FSI-06-2020 patch did not cover them. Apply FSI 14-25 everywhere.

Are you a representative of B. Braun? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Install FSI 14-25, OnlineSuite AP3.0 Security Fix, on every OnlineSuite AP 3.0 and earlier server, including those that already have FSI-06-2020. Restrict network access to the server until the fix is in place.

Apply FSI 14-25. Install the OnlineSuite AP3.0 Security Fix on every affected server.
Do not rely on FSI-06-2020. Treat servers with only the older patch as vulnerable.
Restrict server access. Allow connections only from pumps and administrative hosts that need them.
Rotate exposed secrets. Change any credentials that may have been reachable through the server.

For Device ManufacturersFix the class in the product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What are CVE-2025-3321, CVE-2025-3322 and CVE-2025-3365 in B. Braun OnlineSuite?

They are expression language injection, relative path traversal and hard-coded credentials flaws in B. Braun OnlineSuite AP 3.0 and earlier that may allow privilege escalation, file upload and download and remote code execution with highest privileges (CVSS 10.0).

How do I patch B. Braun OnlineSuite AP 3.0?

B. Braun provides the fix through FSI 14-25, OnlineSuite AP3.0 Security Fix, per its June 6, 2025 statement; installs with the earlier FSI-06-2020 patch are still affected.

Who found the B. Braun OnlineSuite vulnerabilities in 2025?

CODE WHITE GmbH reported CVE-2025-3321, CVE-2025-3322 and CVE-2025-3365 in B. Braun OnlineSuite AP 3.0 and earlier.

← Back to Vulnerabilities