[{"innerBlocks":[],"name":"core\/freeform","postId":431,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"The Food and Drug Administration on Tuesday warned patients and providers about a set of 11 cybersecurity vulnerabilities that may pose risks for certain medical devices and hospital networks. The vulnerabilities\u2014called URGENT\/11\u2014exist in IPnet, a third-party software component that supports network communications between computers, according to the FDA. \u201cURGENT\/11 affects several operating systems that may then impact certain medical devices connected to a communications network, such as wi-fi and public or home Internet, as well as other connected equipment such as routers, connected phones and other critical infrastructure equipment,\u201d states the regulatory agency.In particular, the FDA warned that some versions of the following operating systems are impacted: VxWorks (by Wind River); Operating System Embedded (by ENEA); INTEGRITY (by Green Hills); ThreadX (by Microsoft); ITRON (by TRON Forum); and ZebOS (by IP Infusion). \u201cPlease note the vulnerable IPnet software component may not be included in all versions of these operating systems,\u201d added the FDA\u2019s safety communication<\/a>.

Although the FDA said it is not aware of any confirmed adverse events related to the vulnerabilities, the agency warned that the software to exploit these vulnerabilities is publicly available and that the risk of patient harm\u2014if left unaddressed\u2014could be significant. \u201cThese cybersecurity vulnerabilities may allow a remote user to take control of a medical device and change its function, cause denial of service, or cause information leaks or logical flaws, which may prevent a device from functioning properly or at all,\u201d according to the FDA.\u201cIt\u2019s important for manufacturers to be aware that the nature of these vulnerabilities allows the attack to occur undetected and without user interaction,\u201d said Suzanne Schwartz, MD, deputy director of the Office of Strategic Partnerships and Technology Innovation in the FDA\u2019s Center for Devices and Radiological Health. \u201cBecause an attack may be interpreted by the device as a normal network communication, it may remain invisible to security measures.\u201dThe agency urged medical device <\/b>manufacturers to work with providers to determine which devices might be affected by URGENT\/11 and develop risk mitigation plans.\u201cSome medical device manufacturers are already actively assessing which devices that use these operating systems are affected by URGENT\/11 and identifying risk and remediation actions,\u201d states the FDA. \u201cSeveral manufacturers have also notified their customers consumers with devices determined to be affected so far, which include an imaging system, an infusion pump, and an anesthesia machine.\u201d The agency anticipates that other medical devices will be identified that contain one or more of the vulnerabilities associated with the original IPnet software.","saveContent":"The Food and Drug Administration on Tuesday warned patients and providers about a set of 11 cybersecurity vulnerabilities that may pose risks for certain medical devices and hospital networks. The vulnerabilities\u2014called URGENT\/11\u2014exist in IPnet, a third-party software component that supports network communications between computers, according to the FDA. \u201cURGENT\/11 affects several operating systems that may then impact certain medical devices connected to a communications network, such as wi-fi and public or home Internet, as well as other connected equipment such as routers, connected phones and other critical infrastructure equipment,\u201d states the regulatory agency.In particular, the FDA warned that some versions of the following operating systems are impacted: VxWorks (by Wind River); Operating System Embedded (by ENEA); INTEGRITY (by Green Hills); ThreadX (by Microsoft); ITRON (by TRON Forum); and ZebOS (by IP Infusion). \u201cPlease note the vulnerable IPnet software component may not be included in all versions of these operating systems,\u201d added the FDA\u2019s safety communication<\/a>.Although the FDA said it is not aware of any confirmed adverse events related to the vulnerabilities, the agency warned that the software to exploit these vulnerabilities is publicly available and that the risk of patient harm\u2014if left unaddressed\u2014could be significant. \u201cThese cybersecurity vulnerabilities may allow a remote user to take control of a medical device and change its function, cause denial of service, or cause information leaks or logical flaws, which may prevent a device from functioning properly or at all,\u201d according to the FDA.\u201cIt\u2019s important for manufacturers to be aware that the nature of these vulnerabilities allows the attack to occur undetected and without user interaction,\u201d said Suzanne Schwartz, MD, deputy director of the Office of Strategic Partnerships and Technology Innovation in the FDA\u2019s Center for Devices and Radiological Health. \u201cBecause an attack may be interpreted by the device as a normal network communication, it may remain invisible to security measures.\u201dThe agency urged medical device <\/b>manufacturers to work with providers to determine which devices might be affected by URGENT\/11 and develop risk mitigation plans.\u201cSome medical device manufacturers are already actively assessing which devices that use these operating systems are affected by URGENT\/11 and identifying risk and remediation actions,\u201d states the FDA. \u201cSeveral manufacturers have also notified their customers consumers with devices determined to be affected so far, which include an imaging system, an infusion pump, and an anesthesia machine.\u201d The agency anticipates that other medical devices will be identified that contain one or more of the vulnerabilities associated with the original IPnet software.","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

FDA issues cyber warning for medical devices, hospital networks

More for you