FDA Warns Medical Device Manufacturers of “Urgent” Cybersecurity Flaws

FDA Warns Medical Device Manufacturers of “Urgent” Cybersecurity Flaws

Security researchers found 11 significant vulnerabilities in devices that use the IPnet software, though there are no confirmed incidents involving takeovers of the devices.

After security researchers discovered key flaws in the cybersecurity protections of medical devices, federal officials sent out an official warning about the risks to patients and health care providers on Tuesday. 

The U.S. Food and Drug Administration and Department of Homeland Security released an “urgent” advisory about 11 security flaws, called “URGENT/11,” which rest within the software IPnet. The software, owned by Wind River Systems, is licensed to operating system developers who use IPnet on a wide variety of medical devices. 

While IPnet may not be supported with security updates by the original vendor, some manufacturers have a license that allows them to use it without support, according to the FDA. That has allowed the software to be incorporated into equipment and other systems that are used in medical and industrial devices today. 

“These vulnerabilities may allow anyone to remotely take control of the medical device and change its function, cause denial of service, or cause information leaks or logical flaws, which may prevent device function,” the FDA said in the advisory. 

The agency said it is not aware of any confirmed incidents involving the vulnerabilities, but that there is already publicly available software that allows hackers to take advantage of them. 

Some versions of the following operating systems may be affected by the issues: VxWorks, Operating System Embedded, INTEGRITY, ThreadX, ITRON and ZebOS. The vulnerable IPnet software component may not be included in all versions of those systems, the FDA said. 

In response to the vulnerabilities, some medical device manufacturers are taking action to determine which devices are affected and how they can remediate the cybersecurity issues. Several of those manufacturers have notified customers about the devices that have been identified as insecure, which include an imaging system, an infusion pump and an anesthesia machine. 

While the FDA did not name specific manufacturers or medical devices, the agency did say that it expects more to be identified in the coming months. Microsoft said that its ThreadX product no longer includes IPnet but earlier versions might have included the software. 

“We’ve investigated these reports and confirmed that these vulnerabilities do not impact any ThreadX release,” a Microsoft spokeswoman said via email.

In its advisory, the FDA advised manufacturers to conduct thorough risk assessments of their products and develop a plan for updating devices.

“The FDA will continue to assess new information concerning the URGENT/11 vulnerabilities and will keep the public informed if significant new information becomes available,” the agency said.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • The Power of a Layered Approach to Safety

    In a perfect world, every school would have an unlimited budget to help secure their schools. In reality, schools must prioritize what budget they have while navigating the complexities surrounding school security and lockdown. Read Now

  • How a Security System Can Enhance Arena Safety and the Fan Experience

    Ensuring guests have both a memorable experience and a safe one is no small feat for your physical security team. Stadiums, ballparks, arenas, and other large event venues are increasingly leveraging new technologies to transform the fan experience and maintain a high level of security. The goal is to preserve the integrity and excitement of the event while enhancing security and remaining “behind the scenes.” Read Now

  • Protecting Data is Critical

    To say that the Internet of Things (IoT) has become a part of everyday life would be a dramatic understatement. At this point, you would be hard-pressed to find an electronic device that is not connected to the internet. Read Now

Featured Cybersecurity

Webinars

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3