Vulnerability

Cepheid tells GeneXpert Dx 6.4a sites to switch off TLS 1.0 and TLS 1.1

MedDevice Cyber Staff · Mar 12 · 2 min read · Via Cepheid product security updates

Cepheid published a Critical Vulnerability Notification on March 12, 2026 for GeneXpert Dx 6.4a. The software supports TLS 1.0 and TLS 1.1, which Cepheid calls deprecated and insecure. No CVE is attached. Dx customers running Dx 6.4a are in scope.

The fix is configuration, done by the site. Cepheid walks operators through creating Client and Server keys for each old protocol under the SCHANNEL Protocols registry path, setting Enabled to 0 and DisabledByDefault to 1. The local SQL Server service is then restarted and the handshake rechecked from PowerShell.

Downgrade attacks against old TLS let someone on the path pull a session back to weaker ciphers and read or alter results in transit. On a lab analyzer that talks to a LIS, that traffic is patient data. Back up the registry and test results first, as Cepheid asks, then make the change on every Dx workstation in one pass.

Are you a representative of Cepheid? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Disable TLS 1.0 and TLS 1.1 on every GeneXpert Dx 6.4a workstation using the SCHANNEL registry steps in Cepheid's March 12, 2026 notice, leaving TLS 1.2 and 1.3 enabled. Back up the registry and test result data before the change. There is no software patch; this is a configuration fix the site applies.

Back up first. Back up the registry and the test result database following the Dx 6.4a Operator Manual before touching protocol settings.
Disable the old protocols. Create TLS 1.0 and TLS 1.1 Client and Server keys under SCHANNEL Protocols with Enabled set to 0 and DisabledByDefault set to 1.
Restart and verify. Restart the SQL Server service and confirm from PowerShell that TLS 1.0 and 1.1 handshakes now fail.
Watch the integrations. Check that LIS and middleware connections still negotiate TLS 1.2 after the change, and fix any peer that only spoke the old protocols.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wired network

Contributing

Named operating system Hospital network

GeneXpert Dx

PID-4113 Named operating system Patient or study database

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Questions & Answers

Does Cepheid GeneXpert Dx 6.4a support TLS 1.0 and TLS 1.1?

Yes. Cepheid's March 12, 2026 Critical Vulnerability Notification says GeneXpert Dx 6.4a supports the deprecated TLS 1.0 and TLS 1.1 protocols and tells customers to disable them.

How do I disable TLS 1.0 on a Cepheid GeneXpert Dx 6.4a workstation?

Cepheid's notice says to back up the registry and test data, add TLS 1.0 and TLS 1.1 Client and Server keys under the Windows SCHANNEL Protocols path with Enabled set to 0 and DisabledByDefault set to 1, then restart SQL Server and verify the handshake.

← Back to Vulnerabilities