LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Fresenius says Fresenius Kabi infusion pumps and Conox are not affected by Follina MSDT flaw

MedDevice Cyber Staff · Jul 11 · 2 min read · Via Fresenius Follina statement

Fresenius published a statement on July 11, 2022 on Follina, CVE-2022-30190, the remote code execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT), with a CVSS score of 7.8, rated high. It lists Fresenius Kabi's Agilia, Exelia, Orchestra and INfusia infusion pumps, Amika and Enfusia enteral nutrition pumps, Conox monitoring devices, the Vigilant Software Suite and the Partner and INfusia Centro accessories as not affected in all versions. Update A on December 19, 2024 added the Ivenix infusion pump, the Ivenix Infusion Management System (IMS) and the Ivenix Infusions Dashboard.

Fresenius says none of the Follina vulnerabilities can be exploited on these products. Microsoft describes the trigger as MSDT called through the URL protocol from an application such as Word, so the exposure around a pump fleet lives on the Windows servers and workstations that manage it, and that is where the patching belongs.

Are you a representative of Fresenius Kabi? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Fresenius lists no affected Fresenius Kabi product for Follina, CVE-2022-30190, so no device update applies. Apply Microsoft's fix on the Windows servers and workstations that run alongside the pumps. Keep the device network isolated from general IT.

Patch the Windows tier. Apply Microsoft's CVE-2022-30190 update to servers and clinical workstations near the pump fleet.
Restrict document handling. Keep email and Office document use off machines that manage infusion systems.
Record the assessment. Store the Fresenius statement and its December 19, 2024 Ivenix update with the asset records.
Isolate the medical network. Place Fresenius devices behind firewalls in a dedicated medical network, isolated from other IT networks.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system

Contributing

Hospital network

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Is the Fresenius Kabi Ivenix infusion pump affected by Follina CVE-2022-30190?

No. Update A of the Fresenius Follina statement, dated December 19, 2024, lists the Ivenix infusion pump, Ivenix Infusion Management System (IMS) and Ivenix Infusions Dashboard as not affected by CVE-2022-30190 in all versions.

Which Fresenius Kabi products did Fresenius assess for the Follina MSDT vulnerability?

The July 11, 2022 statement lists Agilia, Exelia, Orchestra and INfusia infusion pumps, Amika and Enfusia enteral nutrition pumps, Conox, the Vigilant Software Suite and the Partner and INfusia Centro accessories as not affected by CVE-2022-30190.

← Back to Vulnerabilities