Vulnerability

Canon Medical flags FragAttacks Wi-Fi flaws in wireless FPD and ultrasound wireless options

MedDevice Cyber Staff · Jul 4 · 2 min read · Via Canon Medical Wi-Fi vulnerabilities information

Canon Medical's security information page on the FragAttacks Wi-Fi vulnerabilities was last updated on July 4, 2022. The IEEE 802.11 flaws, CVE-2020-24586, CVE-2020-24587, CVE-2020-24588 and CVE-2020-26139 through CVE-2020-26147, may potentially affect Canon products with a wireless FPD or the ultrasound wireless communication option.

CT, MR, VL and NM products disable Wi-Fi by default. FragAttacks sit in frame fragmentation and aggregation handling in the Wi-Fi standard and its implementations, so the radio is the exposure and the WLAN design is the control.

Are you a representative of Canon Medical? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Treat Canon wireless FPDs and ultrasound units with the wireless option as exposed to FragAttacks until Canon confirms an update. Keep them on a dedicated WPA2 or WPA3 network and leave Wi-Fi disabled on CT, MR, VL and NM systems.

Identify wireless units. List wireless FPDs and ultrasound systems with the wireless option enabled.
Use a dedicated WLAN. Place these devices on an SSID reserved for imaging equipment.
Keep Wi-Fi off elsewhere. Confirm CT, MR, VL and NM systems still have Wi-Fi disabled.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Wireless FPD

Wireless connectivity

Ultrasound Device

Wireless connectivity

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Versana Active	GE HealthCare	Same attributes (interface and component types)WiFi, Wireless Module	No feedback feed from manufacturer
iBed Wireless with iBed Mobile	Stryker	Same attributes (interface and component types)WiFi, Wireless Module	No feedback feed from manufacturer
Assert-IQ (DM5000)	Abbott	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer
FreeStyle Libre 2 Flash Glucose Monitoring System	Abbott	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
Portrait Central Viewer Application (Portrait CV A01)	GE HealthCare	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer
Image Management V15	Philips	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer
Zenition 70	Philips	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer
Cios Flow	Siemens Healthineers	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer
Connected OR Hub with Device and Voice Control	Stryker	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer
t:slim X2 insulin pump with interoperable technology	Tandem Diabetes Care	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Exposed to the same EMB3D threatTID-202	No feedback feed from manufacturer

Questions & Answers

Which Canon Medical products are affected by FragAttacks?

Canon Medical says the FragAttacks Wi-Fi vulnerabilities may potentially affect products with a wireless FPD or the ultrasound wireless communication option; CT, MR, VL and NM products disable Wi-Fi by default.

What CVEs are included in FragAttacks for Canon Medical devices?

Canon Medical lists CVE-2020-24586, CVE-2020-24587, CVE-2020-24588 and CVE-2020-26139 through CVE-2020-26147 for its wireless FPD and ultrasound wireless option.

← Back to Vulnerabilities