LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Medtronic warns of TiYunZong vulnerability on CT900 tablets running clinician programmer apps

MedDevice Cyber Staff · Nov 19 · 2 min read · Via Medtronic security disclosure

Medtronic published a bulletin on November 19, 2020 on the TiYunZong vulnerability in the Samsung CT900 Android tablets that run its clinician programmer apps: the A610 DBS clinician programmer, A710 Intelis clinician programmer, A71100 Restore clinician application and A810 SynchroMed II clinician programmer.

Exploitation requires a clinician to visit a malicious website in Chrome on the tablet. A successful attack could allow remote access to therapy or patient information or altered device settings.

A clinician programmer tablet that browses the open web is a general-purpose phone with a therapy app on it. Lock the browser down.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Do not use CT900 clinician programmer tablets to browse the web, and follow Medtronic's November 19, 2020 bulletin for updates. Keep the tablets under clinic control and dedicated to programming.

Stop web browsing. Instruct clinicians not to open Chrome or visit websites on CT900 programmer tablets.
Apply Medtronic updates. Install any tablet or app update Medtronic provides for the CT900.
Dedicate the tablets. Keep programmer tablets for programming only and store them securely.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Mobile app

Contributing

Therapy delivery Handles patient data Named operating system

CT900 Samsung Android tablet

Mobile app Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

What is the TiYunZong vulnerability on the Medtronic CT900 tablet?

TiYunZong is a vulnerability in Samsung CT900 Android tablets that run Medtronic clinician programmer apps; per Medtronic's November 19, 2020 bulletin, exploitation requires a clinician to visit a malicious website in Chrome.

Which Medtronic clinician programmer apps run on the CT900 tablet?

Medtronic's November 19, 2020 bulletin lists the A610 DBS clinician programmer, A710 Intelis clinician programmer, A71100 Restore clinician application and A810 SynchroMed II clinician programmer.

← Back to Vulnerabilities