LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Login credentials exposed on the workstation in a GE imaging viewer

MedDevice Cyber Staff · Mar 16 · 2 min read · Via FDA

GE HealthCare Centricity Universal Viewer drew an FDA Class 2 recall, event Z-1569-2026, covering roughly 1,568 units. A flaw exposes user login credentials on the local client workstation, and an attacker with physical access could harvest them.

GE issued an Urgent Medical Device Correction and recommended AD or LDAP network authentication as interim mitigation, which moves auth off the local client onto the directory. Keep secrets off the client, authenticate against a directory, and assume the workstation is a place people can walk up to. In a hospital reading room, they can.

Remediation Desk

GE HealthCare issued an urgent correction for Centricity Universal Viewer after a flaw exposed user login credentials on the local client, logged by FDA as a Class 2 recall. Apply the correction and, since exploitation needs physical access, tighten workstation access control in the interim.

Apply the urgent correction. Install GE's fix for the credential-exposure flaw in Centricity Universal Viewer.
Lock down the workstations. The attack needs local access, so enforce screen locks, disk encryption, and physical controls on reading stations until patched.
Stop storing recoverable credentials on the client. Client software should hold short-lived tokens, not credentials an attacker with local access can harvest.

Sources

FDA ↗

Questions & Answers

Why was GE Centricity Universal Viewer recalled?

A flaw exposed user login credentials on the local client workstation, harvestable by anyone with physical access. FDA logged it as Class 2 recall event Z-1569-2026 covering roughly 1,568 units.

What is the interim mitigation for the Centricity viewer?

GE recommended AD or LDAP network authentication, which moves credential handling off the local client and onto the directory. In a hospital reading room, walking up to the workstation is a realistic threat.

← Back to Vulnerabilities