Vulnerability

Cepheid GeneXpert Xpress 6.4a ships without Windows speculative execution mitigations

MedDevice Cyber Staff · Mar 11 · 2 min read · Via Cepheid product security updates

Cepheid published a Critical Vulnerability Notification on March 11, 2026 for GeneXpert Xpress 6.4a. The Windows install has not implemented Microsoft's recommended mitigations for CPU speculative execution side channels. Twelve CVEs are in scope, from CVE-2017-5715, CVE-2017-5753 and CVE-2017-5754 through CVE-2019-11135 and CVE-2022-0001.

The remedy is two registry values. Administrators set FeatureSettingsOverrideMask to 3 and FeatureSettingsOverride to 8 under Memory Management, verify them in PowerShell, and reboot. Cepheid asks sites to back up the registry and test data first.

These are the Spectre and Meltdown family, fixed in Windows years ago but left off by this configuration. Mitigations that ship disabled by default are a design choice someone should have revisited before release.

Are you a representative of Cepheid? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Enable Windows speculative execution mitigations on GeneXpert Xpress 6.4a by setting FeatureSettingsOverrideMask to 3 and FeatureSettingsOverride to 8 under Memory Management, then reboot, as Cepheid's March 11, 2026 notice directs. Back up the registry and test result data before the change.

Back up the system. Back up the registry and test result data with IT before editing, as Cepheid recommends.
Set the two values. Run the reg add commands from Cepheid's notice to set FeatureSettingsOverrideMask to 3 and FeatureSettingsOverride to 8.
Verify and reboot. Read both values back with Get-ItemProperty, confirm 3 and 8, and restart the workstation.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

GeneXpert Xpress

PID-23 Named operating system

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ Insertable Cardiac Monitor	Abbott	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
LabPro Data Management System	Beckman Coulter	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
DRX - Compass	Carestream Health	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Stelo Glucose Biosensor System	DexCom	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Monaco RTP System	Elekta	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
AutoSeg	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Portrait Central Viewer Application (Portrait CV A01)	GE HealthCare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Venue Fit	GE HealthCare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
ViewPoint 6	GE HealthCare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Brevera Biopsy System with CorLumina Imaging Technology	Hologic	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer

26 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

Is Cepheid GeneXpert Xpress 6.4a affected by Spectre and Meltdown CVEs?

Cepheid's March 11, 2026 notice says Windows on GeneXpert Xpress 6.4a lacks the recommended mitigations for speculative execution CVEs including CVE-2017-5715, CVE-2017-5753 and CVE-2017-5754.

How do I enable speculative execution mitigations on GeneXpert Xpress 6.4a?

Cepheid says to back up the registry and test data, set FeatureSettingsOverrideMask to 3 and FeatureSettingsOverride to 8 under the Memory Management registry key, verify in PowerShell and reboot.

← Back to Vulnerabilities