Vulnerability

Boston Scientific says Ripple20 adds no patient risk to its transvenous cardiac devices

MedDevice Cyber Staff · Jun 25 · 2 min read · Via Boston Scientific Ripple20 statement

Boston Scientific published a statement, Revision 1, on June 25, 2020, on the Ripple20 Treck TCP/IP vulnerabilities. The affected Treck software is used in its transvenous implantable cardiac devices, associated device programmers and LATITUDE Remote Patient Management Systems. S-ICDs do not use it.

The company states the vulnerabilities pose no increased security risk to patients. The statement lists no CVE IDs and no patch, so the assessment rests on Boston Scientific's analysis of how the stack is used in each product.

When a vendor says a known stack flaw is unreachable, ask for the reasoning in writing. It is the only artifact that survives the next audit.

Are you a representative of Boston Scientific? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Boston Scientific states Ripple20 creates no increased patient risk in its transvenous cardiac devices, programmers and LATITUDE systems, and lists no patch. Record the Treck component against these products and request the vendor's assessment basis for your risk file.

Record the component. Add the Treck stack to the inventory entries for affected programmers and LATITUDE systems.
Request the rationale. Ask Boston Scientific for the analysis behind its no-increased-risk statement.
Watch for revisions. Check the statement for updates if new Treck findings appear.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Transvenous implantable cardiac devices

Off-the-shelf software

Device programmers

Off-the-shelf software

LATITUDE Remote Patient Management System

Remote access

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Are Boston Scientific pacemakers and defibrillators affected by Ripple20?

Boston Scientific says the Treck TCP/IP software behind Ripple20 is used in its transvenous implantable cardiac devices, device programmers and LATITUDE Remote Patient Management Systems, but not S-ICDs, and states the vulnerabilities pose no increased security risk to patients.

Do Boston Scientific S-ICDs use the Treck TCP/IP stack?

No. Boston Scientific's June 25, 2020 Ripple20 statement says S-ICDs do not use the affected Treck software.

← Back to Vulnerabilities