LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A 10.0 SQL injection on a patient health portal

MedDevice Cyber Staff · Sep 5 · 2 min read · Via CISA

The Baxter Connex Health Portal, formerly Hillrom and Welch Allyn, drew ICSMA-24-249-01. CVE-2024-6795, unauthenticated SQL injection, base score 10.0, plus CVE-2024-6796, an access-control flaw at 8.2.

A maximum-severity SQL injection means a remote attacker with no credentials runs arbitrary SQL: read, alter or delete data, and admin actions like shutting down the database. On a patient health portal that is every record it holds. Baxter deployed a server-side fix, the one advantage of a hosted portal over shipped software, since the maker patches it once for everyone.

This is the second near-maximum SQL injection in this archive, alongside the Siemens imaging platform. The oldest web vulnerability in the book still lands critical findings on medical software. Parameterize every query.

Remediation Desk

The Baxter Connex Health Portal had a critical unauthenticated SQL injection at base score 10.0 (ICSMA-24-249-01), letting a remote attacker run arbitrary SQL, plus an access-control flaw exposing patient and clinician data. Apply the fix, parameterize queries, and enforce authorization on every record.

Apply the vendor fix. Update the Connex Health Portal to the remediated version from ICSMA-24-249-01.
Parameterize every query. An unauthenticated 10.0 SQL injection means input reached the database unescaped; use parameterized statements everywhere.
Enforce authorization per record. Check on the server that the caller may see each patient or clinician record, closing the access-control gap.

Sources

CISA ↗

Questions & Answers

What is CVE-2024-6795 in the Baxter Connex Health Portal?

An unauthenticated SQL injection rated a maximum 10.0 under ICSMA-24-249-01. A remote attacker with no credentials could run arbitrary SQL against the portal database, alongside CVE-2024-6796, an access control flaw rated 8.2.

Do customers need to patch the Connex Health Portal?

No. The portal is hosted, so Baxter deployed a server-side fix that covers every customer at once with no local action required.

What data was at risk in the Connex portal?

Patient and clinician data held by the portal. A 10.0 SQL injection allows reading, altering or deleting database contents, and the companion access control flaw exposed records directly.

← Back to Vulnerabilities