A legacy cardiology system, end-of-service since 2014, recalled for security

MedDevice Cyber Staff · Jun 10 · 3 min read · Via Cardiovascular Business

A device out of service support since 2014 was still running in enough hospitals to warrant a recall in 2025. That is the legacy-device problem stated plainly.

Capital medical equipment is bought to last, and an information system that still switches on and does its job tends to stay in service long after its vendor has moved on. The software beneath it ages less gracefully. Once support ends, the operating system and bundled components stop receiving fixes, so newly found weaknesses simply accumulate against a product nobody is maintaining.

GE HealthCare recalled legacy MUSE cardiology information systems after determining an outside party could access them to view and manipulate stored patient data. Around 4,200 systems, with the oldest, Muse 5, unsupported since 2014. No CVE, this came through the FDA recall path, and the remediation is upgrade or replace plus hardening: strong passwords, staff awareness, all the compensating controls a hospital applies because the product itself can no longer be fixed.

The records at stake are longitudinal. A cardiology information system stores tracings clinicians revisit across years to judge whether a patient's heart has changed, so an outside party's ability to view or alter that history reaches well past a single visit. Manipulated or deleted studies would corrupt the baseline that later readings are measured against, and confidentiality of the stored data is exposed alongside it.

Because the weakness appeared in a product past the point of patching, the response ran through the recall and correction route rather than a software update, leaning on passwords, staff awareness and other compensating controls to stand in for a fix that can no longer be written. That is the postmarket system absorbing a lifecycle failure after the fact, and it is why end of support belongs in procurement conversations long before it arrives.

End of support has to mean something a customer can act on. Communicate it early, clearly, with a migration path, or you get a decade-old system holding cardiac records with no patches coming.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

GE HealthCare recalled legacy MUSE cardiology systems, roughly 4,200 units and some out of service support since 2014, after finding an outside party could view and manipulate stored patient data. Apply the correction where available and isolate any end-of-service system that cannot be patched.

Follow the recall guidance. Apply GE's corrective action for the affected MUSE systems.
Isolate end-of-service units. Systems past service support since 2014 may have no patch, so segment them off the network and restrict access tightly.
Plan legacy replacement. A device that can no longer be secured is a standing liability; put it on a replacement path.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

app_database data_phi

Contributing

app_user_accounts net_remote_access use_hospital_net app_roles sys_ots_software sys_named_os

EMB3D

PID-26 PID-41

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Why were legacy GE MUSE systems recalled in 2025?

GE HealthCare determined an outside party could access legacy MUSE cardiology information systems to view and manipulate stored patient data. About 4,200 systems were covered, with the oldest, Muse 5, out of service support since 2014.

Is there a patch for the recalled MUSE systems?

No CVE and no patch path. The remediation is upgrade or replace, plus compensating controls like strong passwords and staff awareness, because the product itself can no longer be fixed.

← Back to Vulnerabilities