Top 10 Medical Device Vulnerabilities with Myles Kellerman | Ep. 38

The Med Device Cyber Podcast · with Myles Kellerman · September 30, 2025 This episode of The Med Device Cyber Podcast delves into the 10 most common and dangerous cybersecurity vulnerabilities identified during penetration testing of real-world medical devices. Hosts highlight that unlike traditional cybersecurity, medical device security directly impacts patient safety, introducing "harm" as a critical factor in risk assessment alongside confidentiality, integrity, and availability. The discussion covers hard-coded credentials, unsecured communication channels, and outdated third-party components, emphasizing the importance of SBOM analysis and continuous post-market monitoring. Improper access control, debug interfaces left enabled, and missing firmware integrity checks are also explored, with practical examples of their exploitation and mitigation strategies. The episode further addresses poor session management, fuzzing techniques to uncover buffer overflows and denial-of-service vulnerabilities, tamper detection mechanisms (both physical and logical), and the critical need for rate limiting to prevent brute-force attacks. The hosts stress the proactive adoption of a secure product development framework (DevSecOps) and adherence to standards like IEC 62304 and 81001-5-1 to embed security from design, noting that regulatory bodies like the FDA demand consistent safety, not just "most of the time."

Key Takeaways

• Penetration testing simulates malicious hacker activities to identify and fix vulnerabilities in medical devices *before* they reach the market, ensuring safer products.
• Medical device cybersecurity fundamentally differs from traditional IT security by incorporating "harm" as a primary risk factor, alongside confidentiality, integrity, and availability, due to direct patient safety implications.
• Hard-coded or default credentials, often found during static code analysis or physical device testing, represent a prevalent and easily exploitable vulnerability that can grant unauthorized access.
• Unsecured communication channels, including those with no encryption or reliance on outdated encryption standards, frequently expose sensitive patient data and device functionality to interception or compromise.
• Outdated or vulnerable third-party components, necessitating continuous SBOM analysis and post-market monitoring, are a persistent source of risk even after a device has been cleared for market.
• Improper access control, encompassing both logical and physical vulnerabilities, frequently allows unauthorized users to gain elevated privileges or access sensitive data, highlighting the need for rigorous testing of user roles and permissions.
• The proactive implementation of a secure product development framework, such as DevSecOps, and adherence to relevant standards like IEC 62304 and 81001-5-1 are crucial for embedding security early in the design phase, thus reducing vulnerabilities and associated remediation efforts.
• Effective tamper detection, combining robust audit trails for logical events and physical tamper-evident seals, is critical for identifying and mitigating unauthorized modifications to medical devices.
• Implementing rate limiting and automation controls is essential to prevent brute-force attacks that exploit weak or common passwords, thereby bolstering authentication security.
• Debug interfaces (e.g., JTAG, UART) left enabled or unsecured in production devices pose significant risks, potentially enabling complete system takeover, and must be properly authenticated or physically protected.
• Missing or weak firmware integrity checks (e.g., secure boot, code signing) leave devices vulnerable to unauthorized firmware modifications, emphasizing the need for comprehensive white-box penetration testing during development.

Listen on mdcpodcast.com · Watch on YouTube

Listen to this episode

• Watch on YouTube
• Listen on Apple Podcasts
• Listen on Spotify
• Browse all episodes

---

Want help applying this to your own device program?

Blue Goat Cyber is a specialist medical device cybersecurity firm: 250+ FDA submissions, zero rejections. If anything in this conversation hit close to home, book a 30-minute strategy session - no cost, no obligation.