Vulnerability

Medtronic lists CareLink EHR integration and Vital Sync as affected by Mirth Connect remote code execution flaws

MedDevice Cyber Staff · Nov 30 · 3 min read · Via Medtronic security disclosure

Medtronic published a bulletin on November 30, 2023 on CVE-2023-37679 and CVE-2023-43208 in Mirth Connect, a third-party open source healthcare data integration platform. Both allow attackers to remotely execute arbitrary commands on the hosting server.

Medtronic lists NextGen Mirth Connect 4.4.0 and prior used with Mainspring Data Express CareLink EHR Integration, and the Mirth Connect component of the Vital Sync virtual patient monitoring platform and informatics manager. The company said it was not aware of related cyberattacks, unauthorized access to patient data or patient harm.

An integration engine holds connections into the EHR and every feeding system, so remote command execution there reaches far past one server. Hospitals that run their own Mirth Connect instances have the same exposure on the hospital side.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Identify every Mirth Connect 4.4.0 or earlier instance supporting Mainspring Data Express CareLink EHR Integration or Vital Sync and follow Medtronic's bulletin for updating it. Restrict network access to the Mirth Connect server to the systems that exchange data with it.

Find Mirth Connect instances. Locate the servers running Mirth Connect for CareLink EHR Integration and Vital Sync and record their versions.
Update per Medtronic guidance. Apply the Mirth Connect update path Medtronic specifies for these products.
Restrict server access. Allow only the interfacing systems to reach the Mirth Connect listener and admin ports.
Check hospital-run engines. Patch any other Mirth Connect deployment in the hospital for the same two CVEs.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Contributing

HL7 or FHIR integration Hospital network

Mainspring Data Express CareLink EHR Integration

HL7 or FHIR integration Off-the-shelf software

Vital Sync

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Is Medtronic Vital Sync affected by Mirth Connect CVE-2023-43208?

Yes. Medtronic's November 30, 2023 bulletin lists the Mirth Connect component of the Vital Sync virtual patient monitoring platform as affected by CVE-2023-43208 and CVE-2023-37679.

What Mirth Connect versions are affected in Medtronic products?

Medtronic lists NextGen Mirth Connect 4.4.0 and prior, used with Mainspring Data Express CareLink EHR Integration, as affected by CVE-2023-37679 and CVE-2023-43208, per its November 30, 2023 bulletin.

What can attackers do with CVE-2023-37679 in Mirth Connect?

CVE-2023-37679 and CVE-2023-43208 allow attackers to remotely execute arbitrary commands on the server hosting Mirth Connect, per Medtronic's November 30, 2023 bulletin.

← Back to Vulnerabilities