Security News > 2020 > January > Critical, Unpatched ‘MDhex’ Bugs Threaten Hospital Devices

A collection of six cybersecurity vulnerabilities in a range of GE Healthcare devices for hospitals has been discovered.

Dubbed "MDhex" by the researchers at CyberMDX who discovered them, the bugs would allow attackers to disable the devices, harvest personal health information, change alarm settings and alter device functionality.

CVE-2020-6964, which exists in the integrated service for keyboard switching of the affected devices.

CVE-2020-6966 arises from affected products using a weak encryption scheme for remote desktop control, which may allow an attacker to obtain RCE of devices on the network.

The MDhex vulnerabilities were named in reference to the number of CVEs issued and their existence in medical devices, as well as the potential for bad actors to wreak havoc from a distance "As in a witch's hex," Elad Luz, head of research at CyberMDX, told Threatpost.

News URL

https://threatpost.com/critical-mdhex-bugs-ge-medical-devices/152163/