Vulnerability

Leica Biosystems Aperio and CEREBRO products affected by Mirth Connect vulnerabilities

MedDevice Cyber Staff · Jan 26 · 3 min read · Via Leica Biosystems Mirth Connect advisory

Leica Biosystems published a product security advisory, listed on its index on January 26, 2024, for two vulnerabilities in NextGen Mirth Connect 4.4.1 and earlier: CVE-2023-37679 and CVE-2023-43208. Mirth Connect is the integration engine these products use to communicate with laboratory information systems.

Leica identified multiple impacted products: Aperio eSlide Manager with LIS Connectivity, Aperio Scanner Administration Manager (SAM for RUO), Aperio GT 450 SAM DX Software (23GT450DXSAMSW, 23SAMSWDXIVD), Aperio Scanner Administration Manager DX (SAM for Standalone) and CEREBRO. NextGen recommends upgrading to Mirth Connect 4.4.2 or higher, and Leica is updating its installers.

An interface engine sits between the scanner side and the LIS by design, which makes it a pivot point in both directions. Patch it on the same clock as the LIS.

Are you a representative of Leica Biosystems? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Five Leica Biosystems products embed Mirth Connect 4.4.1 or earlier and are exposed to CVE-2023-37679 and CVE-2023-43208. The fix is Mirth Connect 4.4.2 or higher through Leica's updated installers. Restrict access to the engine until then.

Get Leica's updated installer. Request the updated installer that moves each affected product to Mirth Connect 4.4.2 or higher.
Restrict the interface engine. Allow connections to Mirth Connect only from the LIS and the Leica systems it serves.
Track Mirth in the SBOM. Record Mirth Connect and its version for each Aperio and CEREBRO install.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software HL7 or FHIR integration

Contributing

Hospital network

Aperio eSlide Manager with LIS Connectivity

HL7 or FHIR integration Off-the-shelf software

Aperio Scanner Administration Manager (SAM for RUO)

HL7 or FHIR integration Off-the-shelf software

Aperio GT 450 SAM DX Software

HL7 or FHIR integration Off-the-shelf software

Aperio Scanner Administration Manager DX (SAM for Standalone)

HL7 or FHIR integration Off-the-shelf software

CEREBRO

HL7 or FHIR integration Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Leica Biosystems products use vulnerable Mirth Connect?

Leica Biosystems lists Aperio eSlide Manager with LIS Connectivity, Aperio SAM for RUO, Aperio GT 450 SAM DX Software, Aperio SAM DX (SAM for Standalone) and CEREBRO as impacted by CVE-2023-37679 and CVE-2023-43208 in Mirth Connect 4.4.1 and earlier.

What version of Mirth Connect fixes CVE-2023-43208?

NextGen recommends Mirth Connect 4.4.2 or higher, per Leica Biosystems' advisory listed January 26, 2024. Leica is updating its product installers accordingly.

← Back to Vulnerabilities