LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A low-privilege user can walk past role limits in Synapse Mobility

MedDevice Cyber Staff · Aug 21 · 3 min read · Via CISA

FUJIFILM Healthcare Americas got ICSMA-25-233-01 for its Synapse Mobility enterprise imaging viewer, versions 8.0 through 8.1.1. CVE-2025-54551, external control of an assumed-immutable web parameter. In plain terms, a logged-in user with low privileges edits a search parameter and reaches imaging and patient records their role was never supposed to show them.

Base score 4.3, which undersells how it feels to a compliance team. This is a horizontal access-control break, not a crash. Fixed in 8.2, with interim mitigations to disable search or uncheck the plain-text accession number option. Christopher Alejandro of Moroco reported it.

Assumed-immutable is the phrase to keep. Every parameter a client sends back is one the client can change, so if your authorization only checks the front door, the search box is a side entrance.

Remediation Desk

FUJIFILM Synapse Mobility let an authenticated low-privilege user manipulate a web search parameter to reach imaging and patient data beyond their role (ICSMA-25-233-01). Apply the fix and enforce authorization on the server for every object a request can name.

Apply the vendor update. Install the fixed Synapse Mobility version from ICSMA-25-233-01.
Authorize every object reference. Check on the server that the logged-in user may see the specific record a parameter names, rather than trusting the role at login.
Test for IDOR directly. Include object-reference tampering in your test plan, since role checks alone miss it.

Sources

CISA ↗

Questions & Answers

What is CVE-2025-54551 in FUJIFILM Synapse Mobility?

External control of an assumed-immutable web parameter in versions 8.0 through 8.1.1, covered by ICSMA-25-233-01. A logged-in low-privilege user can edit a search parameter and reach imaging and patient records beyond their assigned role.

How is the Synapse Mobility flaw fixed?

Version 8.2 fixes it. Interim mitigations are disabling search or unchecking the plain-text accession number option. Christopher Alejandro of Moroco reported it.

← Back to Vulnerabilities