Researchers warn of critical vulnerability in GE anesthesia machines

The research points to a broader problem of insecure firmware used in medical devices, according to CyberMDX.

A flaw in the firmware of anesthesia and respiratory devices made by General Electric could allow a hacker to change the composition of gases dispensed by the equipment, putting patients at risk, cybersecurity researchers warned Tuesday.

“If exploited, this vulnerability could directly impact the confidentiality, integrity and availability of device components,” CyberMDX, the health care security company that discovered the issue, said in a statement.

For the vulnerability to be exploited, a hacker would need access to a hospital’s network and for the machines to be connected to a terminal server, or one that allows enterprises to connect to multiple systems, according to CyberMDX. But with that access, an attacker could not only alter gas composition, the researchers said, but also silence alarms on the equipment and change dates and timestamps that document a patient’s surgery.

“Once the integrity of time and date settings has been compromised, you no longer have reliable audit trails,” said Elad Luz, head of research at CyberMDX. “That’s a very serious problem for any medical center.”

The vulnerability is in versions 7100 and 7900 of GE’s Aestiva and Aespire anesthesia devices.

The Department of Homeland Security amplified the warning in a separate advisory on Tuesday that encouraged users to report any malicious activity related to the vulnerability.

A spokesperson for GE’s health care unit said that the company had investigated and found that the scenario described in the research “does not introduce clinical hazard or direct patient risk, and there is no vulnerability with the anesthesia device itself.”

While declining to say how many of the affected devices are in the field, the spokesperson said systems sold after 2009 no longer include the ability to modify gas parameters.

The research points to a broader problem with firmware insecurity in medical devices, Luz told CyberScoop. “Lack of user authentication is a common problem in the design of medical devices and must be addressed,” he said in an email.

CyberMDX first reported the vulnerability to GE in October. Luz lamented the long vulnerability disclosure process in the medical-device industry, which typically involves extensive testing and delicate discussions of when security issues can be made public.

“It should not have taken nine months for publication,” Luz said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure