Vulnerability

Biosense Webster CARTO 3 V6 SP3 applies Windows patches and antivirus updates

MedDevice Cyber Staff · Jan 8 · 2 min read · Via Biosense Webster CARTO 3 V6 SP3 notice

Johnson & Johnson MedTech published a notice on January 8, 2021 on Biosense Webster's CARTO 3 V6 SP3 software update, applied starting December 2020. It applies Windows operating system patches and anti-virus signature updates to close known vulnerabilities in CARTO 3 Version 6.

The listed CVEs include CVE-2018-12207, CVE-2019-11135 and CVE-2019-1318. Bundling OS patches into a validated service pack is how a regulated device keeps pace with Patch Tuesday, and the gap between the two is the window an attacker gets.

Are you a representative of Johnson & Johnson MedTech? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade CARTO 3 Version 6 systems to V6 SP3, which applies the Windows patches and anti-virus signature updates. Confirm each system reports SP3 after the visit.

Upgrade to SP3. Schedule the CARTO 3 V6 SP3 update with Biosense Webster service.
Confirm the build. Verify each CARTO 3 system reports V6 SP3 afterward.
Keep signatures current. Ask Biosense Webster how anti-virus signatures are refreshed between service packs.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

CARTO 3

PID-23 Named operating system Field-updatable firmware

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
EnSite Precision Cardiac Mapping System v2.6	Abbott	Same FDA device type	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Same FDA device type	No feedback feed from manufacturer
CoroFlow Cardiovascular System	Coroventis Research	Same FDA device type	No feedback feed from manufacturer

Questions & Answers

What does Biosense Webster CARTO 3 V6 SP3 fix?

CARTO 3 V6 SP3, applied starting December 2020 and described in a January 8, 2021 notice, applies Windows operating system patches and anti-virus signature updates, closing vulnerabilities including CVE-2018-12207, CVE-2019-11135 and CVE-2019-1318.

How do CARTO 3 Version 6 users get the SP3 security updates?

Biosense Webster's January 8, 2021 notice directs CARTO 3 Version 6 systems to upgrade to V6 SP3, which carries the Windows patches and anti-virus signature updates.

← Back to Vulnerabilities