Vulnerability

Ossur Logic mobile app shipped hard-coded credentials and a static token in its binary

MedDevice Cyber Staff · Dec 19 · 2 min read · Via CISA ICSMA-24-354-01

CISA published advisory ICSMA-24-354-01 on December 19, 2024, for the Ossur Logic mobile application, versions before 1.5.5. Bryan Riggins reported three vulnerabilities.

CVE-2024-53683 (CWE-497, CVSS v3.1 4.4): a valid set of credentials in a .js file and a static token were recovered from the decompiled IPA. An attacker could use them to change the app's translation files and disrupt normal use. CVE-2024-45832 (CWE-798, CVSS 4.3): hard-coded credentials sit in the application binary and form part of the authentication flow. CVE-2024-54681 (CWE-77, CVSS 3.5): bash files in the app's private directory could be used by an attacker who already has full access to the phone to tamper with translations.

The scores are low because the realistic impact is on the app's own content and data. The pattern is worth fixing anyway, since every copy of the app downloaded from a store carries the same secrets, and pulling them out takes a decompiler and an afternoon.

Ossur recommends updating to Version 1.5.5 or later through the device's app store. No other user action is required. Anything compiled into a mobile app should be treated as public from the day it ships.

Are you a representative of Ossur? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the Ossur Logic mobile application to Version 1.5.5 or later through the app store; no other user action is required. For manufacturers, the fix is architectural: keep no shared credentials or static tokens in a shipped app binary.

Update to 1.5.5. Install Ossur Logic 1.5.5 or later from the device's app store.
Check managed devices. Confirm clinic tablets and phones running Logic received the update.
Issue per-user tokens. Replace credentials compiled into the app with tokens issued per user or per device after login.
Scan release builds for secrets. Decompile release builds and search for credentials before submission to the store.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Mobile app

Contributing

User accounts

Logic Mobile Application

Mobile app User accounts

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Libre Rio Continuous Glucose Monitoring System	Abbott	Same platformiOS app	No feedback feed from manufacturer
Stelo Glucose Biosensor System	DexCom	Same platformiOS app	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same platformiOS app	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Same platformiOS app	No feedback feed from manufacturer
InPen System App (MMT-8060 (iOS), MMT-8061	Medtronic	Same platformiOS app	No feedback feed from manufacturer
TipTraQ	Pranaq	Same platformiOS app	No feedback feed from manufacturer
SOMATOM Edge Plus	Siemens Healthineers	Same platformiOS app	No feedback feed from manufacturer
Connected OR Hub with Device and Voice Control	Stryker	Same platformiOS app	No feedback feed from manufacturer
Connected OR Hub with Voice Control	Stryker	Same platformiOS app	No feedback feed from manufacturer
Basal-IQ Technology	Tandem Diabetes Care	Same platformiOS app	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Same signals	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

5 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What vulnerabilities affect the Ossur Logic mobile application?

CISA advisory ICSMA-24-354-01, published December 19, 2024, lists CVE-2024-53683 (credentials and a static token in a .js file, CVSS 4.4), CVE-2024-45832 (hard-coded credentials, CVSS 4.3) and CVE-2024-54681 (bash files in the private directory, CVSS 3.5) in Ossur Logic versions before 1.5.5.

How do I fix the Ossur Logic app vulnerabilities?

Update the Ossur Logic mobile application to Version 1.5.5 or later from the app store on the mobile device. Ossur says no additional action is required, per CISA advisory ICSMA-24-354-01.

← Back to Vulnerabilities