LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A null-pointer dereference can take down a central patient monitor

MedDevice Cyber Staff · Oct 23 · 2 min read · Via CISA

Nihon Kohden earned ICSMA-25-296-01 for the CNS-6201 central monitor, software 01-03 through 01-06. CVE-2025-59668, a null-pointer dereference, base score 7.5. A remote attacker triggers a denial of service on the central station, which is the nurses-station screen aggregating vitals from every bed it watches. Take it down and you have not hurt one patient, you have blinded a unit.

Jared Quinn of QuinnTech.ai reported it. Nihon Kohden publishes an advisory archive going back years, which is more than most of its peers can say. Availability is a safety property here, not an IT metric. A monitor that crashes is a monitor that is not monitoring.

Remediation Desk

A null-pointer dereference can push the Nihon Kohden CNS-6201 central monitoring station into a denial of service (ICSMA-25-296-01, CVSS 7.5), and that station is the screen aggregating bedside vitals. Apply the fix and segment the monitoring network so the input that triggers it cannot arrive from arbitrary hosts.

Apply the vendor update. Install the fixed firmware from ICSMA-25-296-01 on the central stations.
Segment the monitoring VLAN. Keep central stations and bedside monitors on a dedicated segment so malformed input cannot reach them from the general network.
Validate network input. The station should reject malformed messages safely rather than dereferencing a null pointer and dropping the display.

Sources

CISA ↗

Questions & Answers

What is CVE-2025-59668?

A null-pointer dereference in the Nihon Kohden CNS-6201 central monitoring station that can be triggered to push it into a denial of service, rated CVSS 7.5 in ICSMA-25-296-01.

Why does taking down a central station matter clinically?

The central station is the screen that aggregates bedside monitors for the whole unit. If it drops, staff lose the single place they watch, so an availability bug here is a patient-safety concern, not just an IT outage.

What can hospitals do now?

Apply the vendor fix from the advisory and make sure the monitoring network is isolated so that only trusted devices can send traffic to the station.

← Back to Vulnerabilities