Vulnerability

CARTO 3 V4 systems lack Windows patches; Biosense Webster offers free V6 upgrade

MedDevice Cyber Staff · Apr 9 · 3 min read · Via Biosense Webster CARTO 3 V4 notification

Johnson & Johnson MedTech published a Biosense Webster product security notification on April 9, 2018 covering CARTO 3 V4 and all CARTO 3 systems manufactured before April 2018. The systems were missing operating system patches and anti-virus signatures.

The CVE list runs to well over a hundred entries, nearly all 2017 Microsoft Windows flaws, including the SMB set CVE-2017-0143 through CVE-2017-0148 and CVE-2013-6629. Biosense Webster rated the risk controlled: an attacker would need persistent physical access to exploit the OS vulnerabilities.

The free CARTO 3 V6 upgrade applies the patches. A backlog that long is what happens when the OS is frozen at clearance, and the upgrade is the only clean way out.

Are you a representative of Johnson & Johnson MedTech? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade every CARTO 3 V4 system, and any CARTO 3 built before April 2018, to the free CARTO 3 V6 release, which applies the missing operating system patches. Control physical access to the systems until the upgrade is done.

Find V4 systems. List every CARTO 3 on V4 or manufactured before April 2018.
Book the V6 upgrade. Request the free CARTO 3 V6 upgrade from Biosense Webster.
Control physical access. Restrict who can reach the workstation and its ports until upgraded.
Retire stale builds. Do not return a V4 system to service from storage without upgrading it first.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

CARTO 3

PID-23 Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Why did Biosense Webster recommend upgrading CARTO 3 V4 to V6?

Biosense Webster's April 9, 2018 notification found CARTO 3 V4 and systems manufactured before April 2018 missing operating system patches and anti-virus signatures. The free CARTO 3 V6 upgrade applies the patches.

Can CARTO 3 V4 be exploited remotely?

Biosense Webster rated the CARTO 3 V4 risk controlled, saying an attacker would need persistent physical access to exploit the operating system vulnerabilities, per its April 9, 2018 notification.

Which CVEs affect CARTO 3 V4?

The Biosense Webster notification of April 9, 2018 lists well over a hundred CVEs, including CVE-2017-0143 through CVE-2017-0148 and CVE-2013-6629.

← Back to Vulnerabilities