Vulnerability

Leica Biosystems to remove leftover Axeda RemoteCare software over Access:7 flaws

MedDevice Cyber Staff · Apr 6 · 3 min read · Via Leica Biosystems Axeda Access:7 advisory

Leica Biosystems published a security advisory on April 6, 2022 for the seven Axeda remote access vulnerabilities known as Access:7, CVE-2022-25246 to CVE-2022-25252. They affect Leica's discontinued RemoteCare service.

RemoteCare ended on December 31, 2020, but its Axeda software may not have been fully removed. The products named are BOND-ADVANCE and BOND Controller, CEREBRO, HistoCore PEARL, HistoCore PELORIS 3, HistoCore SPECTRA ST, Leica ASP200 (S) and ASP300 (S), Leica ASP6025 (S), and PELORIS and PELORIS II. Leica will remove the Axeda software and RemoteCare during the next maintenance visit; the advisory was last updated May 6, 2022.

Retired remote access that nobody uninstalled is still remote access. Ask for the removal at the next visit and get it confirmed in writing.

Are you a representative of Leica Biosystems? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Leica systems that once used RemoteCare may still carry Axeda software exposed to Access:7. Leica's fix is removal at the next maintenance visit. Request it now and block Axeda traffic until it is done.

Request removal. Ask Leica to remove Axeda and RemoteCare at the next maintenance visit, or sooner.
Block Axeda traffic. Deny outbound Axeda connections from the listed instruments at the firewall.
Confirm in writing. Get written confirmation of removal for each instrument serial number.
Audit other vendors. Check other lab instruments for remote access agents left behind by retired service programs.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Remote access Off-the-shelf software

BOND-ADVANCE, BOND Controller

Remote access Off-the-shelf software

CEREBRO

Remote access Off-the-shelf software

HistoCore PEARL

Remote access Off-the-shelf software

HistoCore PELORIS 3

Remote access Off-the-shelf software

HistoCore SPECTRA ST

Remote access Off-the-shelf software

Leica ASP200 (S), ASP300 (S)

Remote access Off-the-shelf software

Leica ASP6025 (S)

Remote access Off-the-shelf software

PELORIS, PELORIS II

Remote access Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Leica Biosystems products are affected by Axeda Access:7?

Leica Biosystems' April 6, 2022 advisory names BOND-ADVANCE and BOND Controller, CEREBRO, HistoCore PEARL, PELORIS 3 and SPECTRA ST, Leica ASP200 (S), ASP300 (S) and ASP6025 (S), and PELORIS and PELORIS II, where RemoteCare's Axeda software may remain.

How is Leica fixing the Access:7 Axeda vulnerabilities?

Leica Biosystems will remove the Axeda software and RemoteCare during the next maintenance visit, per its April 6, 2022 advisory on CVE-2022-25246 to CVE-2022-25252.

← Back to Vulnerabilities