LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Compounding software that did not encrypt its database traffic by default

MedDevice Cyber Staff · May 15 · 2 min read · Via Baxter Product Security

Baxter published a bulletin on Abacus, its compounding and pharmacy software. The finding: Abacus supports encrypted client-server communication with the SQL database, but transport encryption is not on by default in legacy configurations, so traffic can travel in the clear, open to interception or tampering.

The capability was there. The default was off. That gap between supported and enabled is where a lot of real-world exposure lives, and on software that calculates and records medication preparation, traffic an attacker can read or alter is a safety concern, not just a privacy one. The remediation is to enable TLS 1.2 or higher. Make encrypted the default, because most operators never change one.

Remediation Desk

Abacus supports encrypted client-server communication but did not turn it on by default in legacy configurations, leaving database traffic in the clear. Enable transport encryption on every deployment and confirm no legacy install is still passing SQL unprotected.

Turn encryption on. Enable the transport encryption Abacus already supports across every client-server link, per the Baxter bulletin.
Audit legacy deployments. Find installs that predate the setting and confirm each now negotiates encryption rather than falling back to cleartext.
Make encryption the default. Ship secure-by-default so an operator does not have to know to enable protection that already exists.

Sources

Baxter Product Security ↗

Questions & Answers

What did Baxter disclose about Abacus?

The compounding and pharmacy software supports encrypted client-server communication with its SQL database, but transport encryption was not enabled by default in legacy configurations, leaving traffic open to interception or tampering.

What is the remediation for Abacus installations?

Enable TLS 1.2 or higher. On software that calculates and records medication preparation, readable or alterable traffic is a safety concern, not just a privacy one.

← Back to Vulnerabilities