LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Unauthenticated SQL injection into an imaging database, base score 9.8

MedDevice Cyber Staff · Dec 6 · 3 min read · Via Siemens Healthineers

Siemens Healthineers SHSA-160244 hit syngo.plaza VB30E before VB30E_HF05. CVE-2024-52335, unauthenticated SQL injection, base score 9.8. No auth, no user interaction.

SQL injection in 2024 on an imaging platform is a hard thing to read. It is the oldest bug in the web-application book, and it still puts a database of medical imaging in an attacker hands with one crafted request. Pair it with the later syngo.plaza password advisory and you have two findings in the same product line, both about the boundary between the app and its database.

Fixed in VB30E_HF05. Parameterize every query. There is no clever exception, no performance argument, no legacy reason good enough to concatenate user input into SQL, and there has not been for twenty years.

Remediation Desk

syngo.plaza VB30E failed to sanitize input before the SQL server (Siemens SHSA-160244, base score 9.8), letting an unauthenticated network attacker run arbitrary SQL and compromise the whole database. Apply the Siemens fix and, as a matter of design, parameterize every query.

Apply the Siemens fix. Update syngo.plaza to the remediated build from SHSA-160244.
Parameterize every query. Use parameterized statements so input is never concatenated into SQL; this closes the class, not just the instance.
Segment the database. Keep the imaging database off any network path that does not need it so an unauthenticated attacker cannot reach it.

Sources

Siemens Healthineers ↗

Questions & Answers

What is CVE-2024-52335 in Siemens syngo.plaza?

An unauthenticated SQL injection in syngo.plaza VB30E, base score 9.8, published as Siemens Healthineers advisory SHSA-160244. One crafted request reaches the imaging database with no login and no user interaction.

Which version fixes the syngo.plaza SQL injection?

VB30E_HF05. Versions before that hotfix are affected and should be updated.

← Back to Vulnerabilities