LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Hard-coded credentials and client-side auth in nuclear-medicine software

MedDevice Cyber Staff · Dec 2 · 3 min read · Via CISA

Mirion Medical picked up ICSMA-25-336-01 for its EC2 nuclear-medicine software, the NMIS and BioDose products, versions before 23.0. Five high-severity CVEs. Hard-coded credentials, CVE-2025-64778. Client-side authentication, CVE-2025-61940 at 8.3, meaning the app trusts the browser to decide who is allowed in. Plus incorrect permission assignments up to 8.4.

Chained, they let an attacker modify executables, read sensitive data, gain unauthorized access and run arbitrary code. Joe Dillon reported it.

Client-side authentication is a product built as if the network were friendly. It never is. Auth decisions belong on the server, every time.

Remediation Desk

Mirion Medical EC2 software (NMIS, BioDose) carried five high-severity flaws including hard-coded credentials and authentication enforced only on the client (ICSMA-25-336-01). Apply the fix, and where auth was client-side, treat every control as reachable without it until the server enforces access.

Apply the vendor remediation. Install the fixed EC2 software versions named in ICSMA-25-336-01.
Move authorization to the server. Client-side checks are bypassable, so every privileged action must be re-authorized on the server.
Remove hard-coded credentials. Replace any embedded credential with per-deployment secrets that an operator sets and can rotate.

Sources

CISA ↗

Questions & Answers

What was found in Mirion Medical EC2 software?

ICSMA-25-336-01 lists five high-severity flaws in the EC2 software line, including its NMIS and BioDose products. Two of the headline issues are hard-coded credentials and authentication enforced only on the client side.

Why is client-side authentication a problem?

If the check happens in the client, an attacker can skip the client and talk to the backend directly. The login gate becomes optional, which is why these rate high.

What is the remediation path?

Move to the fixed versions in the advisory, remove or rotate the built-in credentials where the vendor allows it, and keep the software off networks that untrusted users can reach until you have updated.

← Back to Vulnerabilities