LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Default credentials across a line of diagnostic instruments

MedDevice Cyber Staff · Dec 17 · 2 min read · Via CISA

BD Diagnostic Solutions products, the BACTEC, COR, EpiCenter, MAX, Phoenix M50 and Synapsys lines, drew ICSMA-24-352-01. CVE-2024-10476, default credentials, base score 8.0. BD published it on its own bulletin page and is remediating through field service.

An attacker with logical or physical network access uses the shipped login and reads, modifies or deletes data, including PHI. Credit to BD for publishing, because its cybersecurity bulletin page is one of the more complete in the industry, and transparency about your own findings is what regulators and customers increasingly expect. Force credential change on first setup. A device that keeps working with the factory password will still have it in five years, on a network someone eventually reaches.

Remediation Desk

BD Diagnostic Solutions instruments including BACTEC and Phoenix shipped with default credentials, letting an attacker with network access read, modify or delete data including PHI (ICSMA-24-352-01). Change the defaults, segment the instruments, and follow the BD guidance.

Change the default credentials. Set unique credentials on every affected instrument per the BD advisory in ICSMA-24-352-01.
Segment the instruments. Keep diagnostic instruments on a controlled network segment so default-credential access is not reachable broadly.
Force a credential change at setup. Devices should require the default to be changed before they become operational.

Sources

CISA ↗

Questions & Answers

Which BD instruments shipped with default credentials?

The BACTEC, COR, EpiCenter, MAX, Phoenix M50 and Synapsys lines, covered by ICSMA-24-352-01 as CVE-2024-10476, base score 8.0.

What could an attacker do with the BD default credentials?

With logical or physical network access, log in using the shipped credentials and read, modify or delete data, including protected health information.

How is BD remediating the default credential finding?

BD published the advisory on its own bulletin page and is remediating through field service. The durable fix for this bug class is forcing a credential change on first setup.

← Back to Vulnerabilities