Vulnerability

QuidelOrtho will ship Solana instruments with security features on and skips a software fix

MedDevice Cyber Staff · Jan 17 · 3 min read · Via QuidelOrtho Solana customer letter

QuidelOrtho sent Solana Instrument customers an update on January 17, 2024 to its Solana Instrument Security Product Advisory of November 15, 2023, document MM2027820EN00. The original notice described gaps in the software security features of the Solana Instrument, REF 20278 and 20278R, all serial numbers.

The company decided a future software update will not be required. It cites further risk assessments of the instrument and its vulnerabilities, plus the remediation's limited usability constraints, and says the recommended configuration returns the instrument to a secure state.

That configuration turns off the CUPS Interface, which gives access to the CUPS printing interface used for network printing, and turns off Network (SSH), which allows remote login. Labs that print over the network are told to switch to a directly connected DYMO printer. QuidelOrtho will set the optional security features to the most secure configurations by default on new shipments, and it withdrew its earlier advice to disable Virena after finding Virena is not susceptible.

A configuration fix holds only until someone turns SSH back on for a service visit. Put both settings on the lab's periodic check.

Are you a representative of QuidelOrtho? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

QuidelOrtho will not release a software update for the Solana Instrument (REF 20278, 20278R). Turn off the CUPS Interface and Network (SSH) under System, Security Settings, move network printing to a directly connected DYMO printer, and keep the instrument in a secure access location. New shipments arrive with these features set to the most secure configuration.

Turn off CUPS. Select System, Security Settings, CUPS Interface, OFF on each Solana Instrument.
Turn off SSH. Select System, Security Settings, Network (SSH), OFF to remove remote login access.
Switch printers. Replace network printing with a directly connected DYMO printer where it was in use.
Secure the location. Keep each Solana Instrument in a secure access location and recheck the settings after service.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Remote access

Solana Instrument

PID-332 Remote access

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Questions & Answers

Is there a software update for the QuidelOrtho Solana Instrument security advisory?

No. QuidelOrtho said on January 17, 2024 that a future software update will not be required for the Solana Instrument, REF 20278 and 20278R, and that disabling the CUPS Interface and Network (SSH) returns it to a secure state.

Can Solana users keep using Virena after the QuidelOrtho security advisory?

Yes. QuidelOrtho's January 17, 2024 update says Virena is not susceptible to security vulnerabilities and users may resume using it, reversing the November 15, 2023 advice to disable it.

How do labs print from a Solana Instrument with the CUPS Interface off?

QuidelOrtho tells Solana Instrument users who rely on network printing to switch to a directly connected DYMO printer once the CUPS Interface is turned off, per its January 17, 2024 update.

← Back to Vulnerabilities