Vulnerability

Fresenius lists Conox anesthesia monitor as affected by BLUFFS Bluetooth flaw

MedDevice Cyber Staff · Apr 10 · 2 min read · Via Fresenius BLUFFS statement

Fresenius published a statement on April 10, 2024 assessing BLUFFS, the Bluetooth BR/EDR session key weakness tracked as CVE-2023-24023. It lists the Conox device as affected in all versions, naming Conox QM7000-M FW4.10, Conox 2D FW5.10 and Conox DtC FW5.40. The statement was updated December 19, 2024.

Fresenius says Conox Bluetooth links can likely be attacked by a man in the middle, exposing the transmitted EEG and anesthesia index data. Conox communication is uni-directional, so injected data does not affect monitoring.

That limits the harm to confidentiality of the monitoring stream. Keep Bluetooth pairing to known hosts in the room and treat the link as readable by anyone nearby.

Are you a representative of Fresenius Kabi? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Fresenius names no firmware fix for BLUFFS on Conox. The risk is exposure of EEG and anesthesia index data over Bluetooth; injected data does not affect monitoring. Pair Conox only with known hosts and limit Bluetooth use where data exposure matters.

Inventory Conox firmware. Record which Conox units run QM7000-M FW4.10, Conox 2D FW5.10 or Conox DtC FW5.40.
Control pairing. Pair each Conox only with its assigned host and remove stale pairings.
Watch for updates. Track the Fresenius security advisory page for a Conox firmware update addressing CVE-2023-24023.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Physiological waveform processing Handles patient data

Conox

PID-4113 Wireless connectivity Physiological waveform processing Handles patient data

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Assert-IQ (DM5000)	Abbott	Same signals	No feedback feed from manufacturer
FreeStyle Libre 2 Flash Glucose Monitoring System	Abbott	Same signals	No feedback feed from manufacturer
Welch Allyn Connex Spot Monitor; 901058 Vital Signs Monitor Core	Baxter	Same signals	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Same signals	No feedback feed from manufacturer
Zio AT device	iRhythm	Same signals	No feedback feed from manufacturer
IWL2020 Blood Glucose Monitoring System	Roche	Same signals	No feedback feed from manufacturer
Basal-IQ Technology	Tandem Diabetes Care	Same signals	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Same signals	No feedback feed from manufacturer

Questions & Answers

Is Fresenius Conox affected by BLUFFS CVE-2023-24023?

Yes. A Fresenius statement of April 10, 2024, updated December 19, 2024, lists all Conox versions, including QM7000-M FW4.10, Conox 2D FW5.10 and Conox DtC FW5.40, as affected by the Bluetooth BLUFFS flaw CVE-2023-24023.

Can a BLUFFS attack change Conox monitoring readings?

Fresenius says no. Conox communication is uni-directional, so injected data does not affect monitoring, but a man in the middle could expose the transmitted EEG and anesthesia index data.

← Back to Vulnerabilities