Vulnerability

Hologic flags Log4j exposure in PowerChute and a Faxitron CT utility

MedDevice Cyber Staff · Dec 16 · 2 min read · Via Hologic bulletin CTB-00996

Hologic issued bulletin CTB-00996 on December 16, 2021 on CVE-2021-44228, the Apache Log4J flaw. Hologic software does not use Log4J. Third-party software installed alongside it might.

APC PowerChute Business Edition v9.5, the UPS software installed on Advanced Workflow Manager (AWM) and optionally on Unifi Workspace, may use Log4J. A utility program on the Faxitron CT Specimen Radiography System may use Java and Log4J.

Hologic recommends uninstalling PowerChute and removing the Faxitron utility. UPS agents are a classic blind spot on clinical workstations because they are installed once and never inventoried.

Are you a representative of Hologic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Uninstall APC PowerChute Business Edition v9.5 from AWM and Unifi Workspace systems and remove the Faxitron CT utility, as bulletin CTB-00996 recommends. Hologic's own software does not use Log4J.

Uninstall PowerChute. Remove APC PowerChute Business Edition v9.5 from AWM and Unifi Workspace following CTB-00996.
Remove the Faxitron utility. Delete the Java utility program from Faxitron CT Specimen Radiography Systems.
Inventory add-on software. List third-party agents on each clinical workstation so the next library flaw is traced in hours.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Advanced Workflow Manager (AWM)

Off-the-shelf software

Faxitron CT Specimen Radiography System

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Does Hologic software use Log4J?

No. Hologic bulletin CTB-00996 of December 16, 2021 says Hologic software does not use Log4J, but APC PowerChute Business Edition v9.5 on AWM and Unifi Workspace and a utility on the Faxitron CT Specimen Radiography System may.

How do you mitigate Log4Shell on Hologic AWM and Faxitron CT?

Hologic bulletin CTB-00996 recommends uninstalling APC PowerChute Business Edition v9.5 from AWM and Unifi Workspace and removing the Java utility from the Faxitron CT Specimen Radiography System.

← Back to Vulnerabilities