On this page
In this issue
FDA & US regulatory
Letters, guidance, enforcement
CISA KEV & CVEs
Vulnerabilities in your SBOM
Standards & international
AAMI, ISO, IEC, EU MDCG
What to do this week
Concrete actions for security leads
Key Takeaways
- CISA added CVE-2016-3081 (Apache Struts) to the KEV catalog, indicating active exploitation of legacy web servers.
- Unauthenticated attackers can bypass controls on Pulsetto Vagus Nerve Stimulators to alter therapy parameters.
- Total system outages from ransomware are being reported as patient injuries due to treatment delays in radiation oncology.
- Data privacy incidents involving information linked to active implants are triggering mandatory medical device reporting under 21 CFR 803.
- Signal processing failures in cardiac software are causing clinical misdiagnosis, requiring audits of signal filtering thresholds.
- Manual data entry during post-cyberattack recovery is creating significant data integrity risks for blood centers.
The addition of a legacy Apache Struts vulnerability to the CISA KEV catalog highlights active exploitation risks for large-scale imaging systems and lab equipment. Simultaneously, a series of MAUDE reports underscore that data privacy breaches and system outages now trigger mandatory adverse event reporting for Class II and III devices.
This week's updates reveal a tightening intersection between traditional IT security and clinical safety. The inclusion of long-standing vulnerabilities in the Known Exploited Vulnerabilities (KEV) catalog suggests that legacy Java frameworks in medical environments are under active attack. Furthermore, recent adverse event reports indicate that the FDA is receiving filings for ransomware-driven treatment delays and data breaches involving active implants.
Security leads should pay particular attention to the Pulsetto Vagus Nerve Stimulator update, which illustrates how unauthenticated attackers can bypass controls to alter physical therapy parameters via radio. As wireless and wearable neurostimulation technologies proliferate, the risk of unauthorized setting changes becomes a primary patient safety concern that requires immediate firmware auditing.
In this brief
- CISA KEV Addition: Apache Struts Command Injection
- Pulsetto Vagus Nerve Stimulator Vulnerability Update
- Ransomware and Treatment Delays in Radiation Therapy
- Data Privacy Breaches Triggering Adverse Event Reports
- Wearable Pump Safety and Suspected Remote Manipulation
- Software Logic Failures in Cardiac Diagnostic Tools
Why This Matters
For medical device manufacturers, these developments signal that the FDA and CISA are monitoring not just hardware failures, but the clinical consequences of cybersecurity incidents. When a network breach leads to a treatment delay or a privacy leak affects an implantable device user, it is increasingly viewed through the lens of patient safety and regulatory compliance.
CISA KEV Addition: Apache Struts Command Injection
CISA has added CVE-2016-3081 to its Known Exploited Vulnerabilities catalog.
Pulsetto Vagus Nerve Stimulator Vulnerability Update
A recent update regarding the Pulsetto Vagus Nerve Stimulator reveals that unauthenticated attackers can bypass standard controls.
Ransomware and Treatment Delays in Radiation Therapy
A MAUDE adverse event report for the Varian ARIA Radiation Therapy Management software highlights that total system outages constitute reportable patient injuries.
Data Privacy Breaches Triggering Adverse Event Reports
A report involving a Medtronic IPG indicates that data privacy incidents now trigger mandatory medical device reporting if the breach involves information linked to active implants.
Wearable Pump Safety and Suspected Remote Manipulation
A MAUDE report for the Medtronic MiniMed 780G describes a patient injury linked to suspected unauthorized remote manipulation of insulin delivery via Bluetooth.
Software Logic Failures in Cardiac Diagnostic Tools
A software logic failure in the MicroPort CRM HookUp signifies that signal processing algorithms can misinterpret physiological data as device artifacts.
What to do this week
- Cross-reference your current SBOM against the CISA KEV catalog for CVE-2016-3081 and Apache Struts vulnerabilities.
- Review your adverse event reporting SOPs to ensure IT-related outages and data breaches are evaluated under 21 CFR 803 criteria.
- Audit wireless firmware for all Bluetooth-enabled therapy devices to identify and disable any active debug commands or unauthenticated access points.
How Blue Goat Cyber Helps
Blue Goat Cyber assists medical device manufacturers in navigating complex regulatory requirements, including Section 524B of the FD&C Act. We provide specialized penetration testing and security architecture reviews to identify vulnerabilities like those found in legacy Java frameworks or wireless protocols before they lead to adverse events.
FAQ
How does Section 524B affect vulnerability management? It requires manufacturers to have a plan for monitoring and addressing postmarket vulnerabilities, including coordinated disclosure and providing an SBOM.
What is the FDA notification timeline for uncontrolled risks? According to 2016 guidance, manufacturers should notify customers within 30 days of learning of an uncontrolled risk.
Are ransomware attacks reportable to the FDA? Yes, if a ransomware-induced system outage results in a significant treatment delay or patient injury, it must be reported as an adverse event.
Get the next issue
Subscribe to stay informed on the latest regulatory updates and security threats at Goat's Weekly.