FDA Warns Medical Device Manufacturers of “Urgent” Cybersecurity Flaws

FDA Warns Medical Device Manufacturers of “Urgent” Cybersecurity Flaws

Security researchers found 11 significant vulnerabilities in devices that use the IPnet software, though there are no confirmed incidents involving takeovers of the devices.

After security researchers discovered key flaws in the cybersecurity protections of medical devices, federal officials sent out an official warning about the risks to patients and health care providers on Tuesday. 

The U.S. Food and Drug Administration and Department of Homeland Security released an “urgent” advisory about 11 security flaws, called “URGENT/11,” which rest within the software IPnet. The software, owned by Wind River Systems, is licensed to operating system developers who use IPnet on a wide variety of medical devices. 

While IPnet may not be supported with security updates by the original vendor, some manufacturers have a license that allows them to use it without support, according to the FDA. That has allowed the software to be incorporated into equipment and other systems that are used in medical and industrial devices today. 

“These vulnerabilities may allow anyone to remotely take control of the medical device and change its function, cause denial of service, or cause information leaks or logical flaws, which may prevent device function,” the FDA said in the advisory. 

The agency said it is not aware of any confirmed incidents involving the vulnerabilities, but that there is already publicly available software that allows hackers to take advantage of them. 

Some versions of the following operating systems may be affected by the issues: VxWorks, Operating System Embedded, INTEGRITY, ThreadX, ITRON and ZebOS. The vulnerable IPnet software component may not be included in all versions of those systems, the FDA said. 

In response to the vulnerabilities, some medical device manufacturers are taking action to determine which devices are affected and how they can remediate the cybersecurity issues. Several of those manufacturers have notified customers about the devices that have been identified as insecure, which include an imaging system, an infusion pump and an anesthesia machine. 

While the FDA did not name specific manufacturers or medical devices, the agency did say that it expects more to be identified in the coming months. Microsoft said that its ThreadX product no longer includes IPnet but earlier versions might have included the software. 

“We’ve investigated these reports and confirmed that these vulnerabilities do not impact any ThreadX release,” a Microsoft spokeswoman said via email.

In its advisory, the FDA advised manufacturers to conduct thorough risk assessments of their products and develop a plan for updating devices.

“The FDA will continue to assess new information concerning the URGENT/11 vulnerabilities and will keep the public informed if significant new information becomes available,” the agency said.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Maximizing Your Security Budget This Year

    The Importance of Proactive Security Measures: 4 Stories of Regret

    We all want to believe that crime won’t happen to us. So, some business owners hope for the best and put proactive security measures on the back burner, because other things like growth, attracting new customers, and meeting deadlines all seem more pressing. Read Now

  • New Uses for AI

    New applications of AI in IP cameras are delivering precise detection, robust search capabilities, elevated data analysis and enhanced image quality. When combined with built-in analytics, AI can help streamline forensic investigations and also supports several mission-critical business functions. Read Now

  • The Critical Missing Piece

    As technology advances, security programs have invested heavily in advanced systems and sensors. These sensors generate massive amounts of data, often overwhelming the security teams tasked with monitoring them. AI technology promises to sift through this data, using logic and reasoning to differentiate potential threats from non-threats. Read Now

  • Computers Beginning to Come Back Online After CrowdStrike Caused Crash Friday

    Computers around the world are beginning to come back online after a defective update to Windows machines from cybersecurity provider CrowdStrike Friday affected almost 9 million machines. Read Now

Featured Cybersecurity

Webinars

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3