Vulnerability

Thermo Fisher Xcalibur and Foundation driver packages allow local privilege escalation

MedDevice Cyber Staff · Jan 22 · 3 min read · Via Thermo Fisher Xcalibur and Foundation bulletin

Thermo Fisher Scientific released a bulletin and patch on January 22, 2025 for CVE-2024-55957, affecting Xcalibur before 4.7 SP1 and Foundation Instrument Control Software before 3.1 SP10. The bulletin was last updated on June 13, 2025.

Public CVE records describe a local privilege escalation in driver packages due to improper access permissions. A user already on the workstation can use the weak permissions to raise their rights.

The fixed builds are Xcalibur 4.7 SP1 and Foundation 3.1 SP10. Instrument PCs tend to collect shared logins, which is exactly the population a local escalation feeds on.

Are you a representative of Thermo Fisher Scientific? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Xcalibur before 4.7 SP1 and Foundation before 3.1 SP10 ship driver packages with improper access permissions, CVE-2024-55957. Install Xcalibur 4.7 SP1 and Foundation 3.1 SP10. Reduce local accounts on instrument PCs.

Upgrade Xcalibur. Install Xcalibur 4.7 SP1 or later on every workstation.
Upgrade Foundation. Install Foundation Instrument Control Software 3.1 SP10 or later.
Remove shared logins. Replace shared local accounts on instrument PCs with named, least-privilege accounts.
Check driver folder permissions. Confirm standard users cannot write to the instrument driver package locations after the upgrade.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Named operating system

Xcalibur

User accounts

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ Insertable Cardiac Monitor	Abbott	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
LabPro Data Management System	Beckman Coulter	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
DRX - Compass	Carestream Health	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Xpert C. difficile/Epi	Cepheid	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Stelo Glucose Biosensor System	DexCom	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
MOSAIQ Oncology Information System	Elekta	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
AutoSeg	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Portrait Central Viewer Application (Portrait CV A01)	GE HealthCare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
ViewPoint 6	GE HealthCare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Brevera Biopsy System with CorLumina Imaging Technology	Hologic	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer

16 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2024-55957 in Thermo Fisher Xcalibur?

CVE-2024-55957 is a local privilege escalation in driver packages due to improper access permissions, affecting Xcalibur before 4.7 SP1 and Foundation Instrument Control Software before 3.1 SP10. Thermo Fisher released a patch on January 22, 2025.

Which Xcalibur version fixes CVE-2024-55957?

Xcalibur 4.7 SP1 and Foundation Instrument Control Software 3.1 SP10 address CVE-2024-55957, per Thermo Fisher's January 22, 2025 bulletin.

← Back to Vulnerabilities