On 30 January 2025, the US Food and Drug Administration (FDA) issued a safety communication on cybersecurity vulnerabilities in the CMS8000 patient monitor. According to the published information, the vulnerabilities involved three main issues:
1. Bypassing network settings
The affected products sent remote access requests to a hard-coded IP address, bypassing the existing device network settings. This could allow malicious actors to upload and overwrite files on the device.
2. Remote code execution
Attackers could send specially formatted UDP requests to write arbitrary data, enabling remote code execution and opening the door to unauthorised control of the device.
3. Leakage of patient data
When a patient was connected to the monitor, patient data were transmitted in plain text to a hard-coded public IP address. If exploited, any device holding that IP address could obtain confidential patient information, and man-in-the-middle attacks became possible.
If such vulnerabilities are exploited, unauthorised users could take remote control of monitors and stop them working properly – a serious threat to patient health and safety.
Regulators are tightening requirements
In response to the growing threat, the FDA, the EU and China’s National Medical Products Administration (NMPA) have issued a series of cybersecurity regulations and guidance documents:
- March 2023 – USA: the new Section 524B of the Federal Food, Drug, and Cosmetic Act (FD&C Act) requires sponsors of “cyber devices” to include cybersecurity information in premarket submissions; FDA may refuse to accept submissions that lack it.
- September 2023 – USA: FDA published the final guidance “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions”, setting out in detail what cybersecurity documentation is expected.
- March 2024 – USA: FDA published the draft guidance “Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act”, clarifying the definition of a cyber device and the content requirements; these updates have since been incorporated into a revised version of the premarket cybersecurity guidance.
- December 2019 – EU: MDCG 2019-16 “Guidance on Cybersecurity for medical devices” set out detailed expectations and is now a key reference for notified bodies assessing cybersecurity documentation under the MDR and IVDR.
- 2022 – China: the NMPA published its revised “Guideline for the Registration Review of Medical Device Cybersecurity”, defining requirements for the cybersecurity part of registration dossiers.
Manufacturers therefore face a clear challenge: how to manage cybersecurity effectively and prepare documentation that meets the requirements of each market.
How EVERBIZ can help
EVERBIZ supports manufacturers with:
- integrating cybersecurity into medical device risk management;
- applying the general cybersecurity requirements and demonstrating how they are met;
- preparing cybersecurity documentation for FDA submissions;
- preparing documentation that meets CE requirements under the MDR and IVDR;
- preparing documentation for NMPA registration.
Contact us to discuss your project.
This article is for general information only and does not constitute legal advice.