Vulnerability

Beckman Coulter patches DxONE Insights for Log4j and gives Command Central and LabPro guidance

MedDevice Cyber Staff · Dec 13 · 3 min read · Via Beckman Coulter Apache Log4j security information

Beckman Coulter published its Apache Log4j assessment on December 13, 2021, covering CVE-2021-44228 and CVE-2021-45046 and calling it a critical vulnerability. The page was last updated on July 13, 2023.

Three products carry action. The Log4j patch was applied to DxONE Insights. DxONE Command Central includes an unused copy of Log4j in its install package, and Beckman Coulter supplies removal instructions. LabPro Workstation and Database Computers (Microbiology) are exposed only through Axeda services, which should be removed, and most other listed instruments report no impact.

An unused library still shows up in every scan and every attacker's file search. Delete it rather than argue about reachability.

Are you a representative of Beckman Coulter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

DxONE Insights already has the Log4j patch. DxONE Command Central needs the unused Log4j removed using Beckman Coulter's instructions, and LabPro computers need their Axeda services removed. Confirm each step on every installation.

Confirm the DxONE Insights patch. Verify each DxONE Insights install carries the Log4j patch Beckman Coulter applied.
Remove unused Log4j. Follow Beckman Coulter's instructions to strip the unused Log4j from DxONE Command Central installations.
Remove Axeda from LabPro. Have Axeda services removed from LabPro Workstation and Database Computers, which closes their only Log4j exposure.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Contributing

Patient or study database

DxONE Command Central

Off-the-shelf software

LabPro Workstation and Database Computers (Microbiology)

Patient or study database Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Is Beckman Coulter DxONE Command Central affected by Log4j CVE-2021-44228?

Beckman Coulter's Log4j notice of December 13, 2021 says DxONE Command Central includes unused Log4j in its install package, and the company provides removal instructions.

How are Beckman Coulter LabPro computers exposed to Log4j?

According to Beckman Coulter's December 13, 2021 Log4j notice, LabPro Workstation and Database Computers (Microbiology) are exposed only through Axeda services, which should be removed.

← Back to Vulnerabilities