LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Stored passwords recoverable in a Siemens imaging platform

MedDevice Cyber Staff · Feb 10 · 2 min read · Via Siemens Healthineers

Siemens Healthineers advisory SSA-016040 covers syngo.plaza VB30E before VB30E_HF07. CVE-2024-52334, weak encoding for a stored password, base score 5.3.

Weak encoding is not encryption. It is a reversible transform that looks like protection to an auditor and offers none to an attacker who can read the store. Recover the scheme and the passwords fall out. Store them hashed, salted, one-way, so that not even your own software can recover the plaintext. The fix is VB30E_HF07.

Remediation Desk

syngo.plaza VB30E stored passwords with weak encoding, so an attacker could recover the originals (Siemens SSA-016040). Update to VB30E_HF07 and force a password reset for every account, since stored secrets should be assumed recovered.

Update to VB30E_HF07. Apply the fixed build named in Siemens SSA-016040.
Reset all passwords. Weak encoding means stored secrets may already be recovered, so rotate every account after updating.
Hash with a modern algorithm. Store credentials with a salted, slow password hash so recovery from the store is not feasible even if it leaks.

Sources

Siemens Healthineers ↗

Questions & Answers

What is the weakness in Siemens syngo.plaza?

syngo.plaza VB30E stored passwords with weak encoding. An attacker who reached the stored values could recover the original passwords and gain unauthorized access. It is tracked as CVE-2024-52334 in Siemens advisory SSA-016040.

How would an attacker use it?

They first need access to where the passwords are stored. From there, weak encoding means recovering the real passwords is straightforward, which then opens the account those credentials belong to.

What is the response?

Move to the fixed version in SSA-016040 and rotate the affected passwords once patched, since the old values may already be recoverable.

← Back to Vulnerabilities