FDA Warns Medical Device Manufacturers of “Urgent” Cybersecurity Flaws

FDA Warns Medical Device Manufacturers of “Urgent” Cybersecurity Flaws

Security researchers found 11 significant vulnerabilities in devices that use the IPnet software, though there are no confirmed incidents involving takeovers of the devices.

After security researchers discovered key flaws in the cybersecurity protections of medical devices, federal officials sent out an official warning about the risks to patients and health care providers on Tuesday. 

The U.S. Food and Drug Administration and Department of Homeland Security released an “urgent” advisory about 11 security flaws, called “URGENT/11,” which rest within the software IPnet. The software, owned by Wind River Systems, is licensed to operating system developers who use IPnet on a wide variety of medical devices. 

While IPnet may not be supported with security updates by the original vendor, some manufacturers have a license that allows them to use it without support, according to the FDA. That has allowed the software to be incorporated into equipment and other systems that are used in medical and industrial devices today. 

“These vulnerabilities may allow anyone to remotely take control of the medical device and change its function, cause denial of service, or cause information leaks or logical flaws, which may prevent device function,” the FDA said in the advisory. 

The agency said it is not aware of any confirmed incidents involving the vulnerabilities, but that there is already publicly available software that allows hackers to take advantage of them. 

Some versions of the following operating systems may be affected by the issues: VxWorks, Operating System Embedded, INTEGRITY, ThreadX, ITRON and ZebOS. The vulnerable IPnet software component may not be included in all versions of those systems, the FDA said. 

In response to the vulnerabilities, some medical device manufacturers are taking action to determine which devices are affected and how they can remediate the cybersecurity issues. Several of those manufacturers have notified customers about the devices that have been identified as insecure, which include an imaging system, an infusion pump and an anesthesia machine. 

While the FDA did not name specific manufacturers or medical devices, the agency did say that it expects more to be identified in the coming months. Microsoft said that its ThreadX product no longer includes IPnet but earlier versions might have included the software. 

“We’ve investigated these reports and confirmed that these vulnerabilities do not impact any ThreadX release,” a Microsoft spokeswoman said via email.

In its advisory, the FDA advised manufacturers to conduct thorough risk assessments of their products and develop a plan for updating devices.

“The FDA will continue to assess new information concerning the URGENT/11 vulnerabilities and will keep the public informed if significant new information becomes available,” the agency said.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Allegion, Comfort Technologies Implement Mobile Credentials at the Artisan Apartment Homes in Florida

    Artisan Apartment Homes, a luxury apartment complex in Dunedin, Florida, recently transitioned from mechanical keys to electronic locks and centralized system software with support from Allegion US, a leading provider of security solutions, technology and services, and Florida-based Comfort Technologies, which specializes in deploying multifamily access control, IoT devices and software management solutions. Read Now

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.