LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

BMC Medical and 3B Medical Luna CPAP Wi-Fi module crashes on malformed input

MedDevice Cyber Staff · Aug 15 · 2 min read · Via CISA ICSMA-17-227-01

CISA published advisory ICSMA-17-227-01 on August 15, 2017, for the Luna CPAP machine sold by BMC Medical and 3B Medical. The flaw, CVE-2017-12701, is improper input validation (CWE-20) with a CVSS v3 base score of 4.6.

An authenticated attacker can crash the CPAP's Wi-Fi module and cause a denial of service. The vector requires adjacent network access and low privileges. The impact lands on the radio module, with low integrity and availability ratings, and CISA describes no effect on the airflow therapy itself.

The fix arrived with newer production: devices released after July 1, 2017 address the vulnerability. For devices released before that date, BMC Medical and 3B Medical offer no mitigations.

For a home device, a Wi-Fi crash mostly means lost data reporting. The harder problem is the installed base: units sold before July 2017 keep the flaw for as long as patients keep them.

Are you a representative of BMC Medical, 3B Medical? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no fix for Luna CPAP machines released before July 1, 2017, and BMC Medical and 3B Medical offer no mitigation for them. Devices released after that date address CVE-2017-12701. Track which units in your fleet predate the cutoff and plan replacement where Wi-Fi reporting matters.

Identify pre-July 2017 units. Check release dates on Luna CPAP machines; only units released before July 1, 2017 carry the flaw.
Replace where reporting matters. Swap older units for post-cutoff devices when therapy data reporting over Wi-Fi is clinically needed.
Validate radio input on the module. Design Wi-Fi module firmware to reject malformed frames and recover without a full module crash.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Home use Therapy delivery

Luna CPAP Machine

Wireless connectivity Home use Therapy delivery

Fix the class in your product

Malformed or excessive input pushes the service over, and on a monitor that means the screen goes dark. As the maker, validate and bound every input at the boundary, handle malformed messages as a defined error path, and watchdog the clinical display so a fault recovers to a safe view.

Validate and bound input. Enforce type, size, and rate limits; null-check before you dereference.
Fail safe. Handle malformed input as a defined error path, never an unchecked dereference.
Watchdog the display. On a monitor, restore the clinical view quickly and safely after a fault.

Mapped EMB3D mitigations

Questions & Answers

Is there a patch for CVE-2017-12701 in the Luna CPAP machine?

No patch exists for older units. CISA advisory ICSMA-17-227-01, published August 15, 2017, says the Luna CPAP Wi-Fi module crash (CVE-2017-12701) is addressed in devices released after July 1, 2017, and BMC Medical and 3B Medical offer no mitigations for devices released before that date.

What can an attacker do with the BMC Medical Luna CPAP Wi-Fi vulnerability?

An authenticated attacker on an adjacent network can send malformed input that crashes the Luna CPAP's Wi-Fi module, a denial of service tracked as CVE-2017-12701 with a CVSS v3 score of 4.6, per CISA advisory ICSMA-17-227-01.

← Back to Vulnerabilities