FDA Warns Medical Device Manufacturers of “Urgent” Cybersecurity Flaws

FDA Warns Medical Device Manufacturers of “Urgent” Cybersecurity Flaws

Security researchers found 11 significant vulnerabilities in devices that use the IPnet software, though there are no confirmed incidents involving takeovers of the devices.

After security researchers discovered key flaws in the cybersecurity protections of medical devices, federal officials sent out an official warning about the risks to patients and health care providers on Tuesday. 

The U.S. Food and Drug Administration and Department of Homeland Security released an “urgent” advisory about 11 security flaws, called “URGENT/11,” which rest within the software IPnet. The software, owned by Wind River Systems, is licensed to operating system developers who use IPnet on a wide variety of medical devices. 

While IPnet may not be supported with security updates by the original vendor, some manufacturers have a license that allows them to use it without support, according to the FDA. That has allowed the software to be incorporated into equipment and other systems that are used in medical and industrial devices today. 

“These vulnerabilities may allow anyone to remotely take control of the medical device and change its function, cause denial of service, or cause information leaks or logical flaws, which may prevent device function,” the FDA said in the advisory. 

The agency said it is not aware of any confirmed incidents involving the vulnerabilities, but that there is already publicly available software that allows hackers to take advantage of them. 

Some versions of the following operating systems may be affected by the issues: VxWorks, Operating System Embedded, INTEGRITY, ThreadX, ITRON and ZebOS. The vulnerable IPnet software component may not be included in all versions of those systems, the FDA said. 

In response to the vulnerabilities, some medical device manufacturers are taking action to determine which devices are affected and how they can remediate the cybersecurity issues. Several of those manufacturers have notified customers about the devices that have been identified as insecure, which include an imaging system, an infusion pump and an anesthesia machine. 

While the FDA did not name specific manufacturers or medical devices, the agency did say that it expects more to be identified in the coming months. Microsoft said that its ThreadX product no longer includes IPnet but earlier versions might have included the software. 

“We’ve investigated these reports and confirmed that these vulnerabilities do not impact any ThreadX release,” a Microsoft spokeswoman said via email.

In its advisory, the FDA advised manufacturers to conduct thorough risk assessments of their products and develop a plan for updating devices.

“The FDA will continue to assess new information concerning the URGENT/11 vulnerabilities and will keep the public informed if significant new information becomes available,” the agency said.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3