LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A legacy cardiology system, end-of-service since 2014, recalled for security

MedDevice Cyber Staff · Jun 10 · 3 min read · Via Cardiovascular Business

A device out of service support since 2014 was still running in enough hospitals to warrant a recall in 2025. That is the legacy-device problem stated plainly.

GE HealthCare recalled legacy MUSE cardiology information systems after determining an outside party could access them to view and manipulate stored patient data. Around 4,200 systems, with the oldest, Muse 5, unsupported since 2014. No CVE, this came through the FDA recall path, and the remediation is upgrade or replace plus hardening: strong passwords, staff awareness, all the compensating controls a hospital applies because the product itself can no longer be fixed.

End of support has to mean something a customer can act on. Communicate it early, clearly, with a migration path, or you get a decade-old system holding cardiac records with no patches coming.

Remediation Desk

GE HealthCare recalled legacy MUSE cardiology systems, roughly 4,200 units and some out of service support since 2014, after finding an outside party could view and manipulate stored patient data. Apply the correction where available and isolate any end-of-service system that cannot be patched.

Follow the recall guidance. Apply GE's corrective action for the affected MUSE systems.
Isolate end-of-service units. Systems past service support since 2014 may have no patch, so segment them off the network and restrict access tightly.
Plan legacy replacement. A device that can no longer be secured is a standing liability; put it on a replacement path.

Sources

Cardiovascular Business ↗

Questions & Answers

Why were legacy GE MUSE systems recalled in 2025?

GE HealthCare determined an outside party could access legacy MUSE cardiology information systems to view and manipulate stored patient data. About 4,200 systems were covered, with the oldest, Muse 5, out of service support since 2014.

Is there a patch for the recalled MUSE systems?

No CVE and no patch path. The remediation is upgrade or replace, plus compensating controls like strong passwords and staff awareness, because the product itself can no longer be fixed.

← Back to Vulnerabilities