Vulnerability

Fresenius Medical Care DataCOM Gateways with ESF 6.x affected by Log4j flaws

MedDevice Cyber Staff · Dec 21 · 2 min read · Via Fresenius Apache Log4j statement

Fresenius published a group statement on December 21, 2021 on the Apache Log4j vulnerabilities CVE-2021-44228 (Log4Shell), CVE-2021-45046 and CVE-2021-45105. It lists three Fresenius Medical Care products as affected: the Infrastructure Data Management Systems (IDMS) DataCOM Gateway, the Home Bridge DataCOM Gateway and the Remote Service DataCOM Gateway, each with ESF Version 6.x.

Many other Fresenius Medical Care and Fresenius Kabi products were assessed as not affected. The statement was updated through June 9, 2022. Gateways are where dialysis data leaves the machine for the network, so they are the components to fix first.

Are you a representative of Fresenius Medical Care? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Fresenius lists the DataCOM Gateways with ESF Version 6.x as affected by the Log4j flaws. Follow the Fresenius statement for the gateway update and restrict outbound traffic from the gateways until it is applied.

Find ESF 6.x gateways. Inventory IDMS, Home Bridge and Remote Service DataCOM Gateways and their ESF versions.
Apply the Fresenius guidance. Follow the updated Fresenius statement for the gateway remediation.
Restrict egress. Allow gateways to reach only their defined servers, which blocks the outbound lookups Log4Shell relies on.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Contributing

Remote access

DataCOM Gateway

Off-the-shelf software Remote access

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Fresenius products are affected by Log4Shell?

The Fresenius group statement of December 21, 2021 lists the Fresenius Medical Care IDMS DataCOM Gateway, Home Bridge DataCOM Gateway and Remote Service DataCOM Gateway with ESF Version 6.x as affected by CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105.

Are Fresenius Kabi products affected by Log4j?

The Fresenius group Log4j statement, first published December 21, 2021 and updated through June 9, 2022, says many Fresenius Kabi and Fresenius Medical Care products were assessed as not affected; the affected list names the DataCOM Gateways with ESF Version 6.x.

← Back to Vulnerabilities