FDA Issues Alert About Vulnerability in Apache Software
The FDA recently sent out an email alert warning of a cybersecurity vulnerability in Apache’s Log4j software library (specifically versions 2.0-beta9 to 2.14.1). Log4j is an open-source, Java-based logging utility that is used in consumer and enterprise services, websites and applications, including medical devices and supporting systems, to log security and performance information. The vulnerabilities could introduce risks for certain medical devices that would render the device unavailable. In addition, an unauthorized user could remotely control the device and potentially negatively impact its safety and effectiveness.
“These vulnerabilities may introduce risks for certain medical devices where the device could be made unavailable, or an unauthorized user could remotely impact the device functionality,” the agency stated in an email alert. “At this time, the FDA is not aware of any confirmed adverse events affecting medical devices related to these vulnerabilities.”
“As this is an ongoing and still evolving issue, we also recommend continued vigilance and response to ensure medical devices are appropriately secured,” FDA stated in the Cybersecurity section of its website.
The Cybersecurity & Infrastructure Security Agency (CISA) is urging users and administrators to review the vulnerability announcement and make any necessary upgrades or mitigations immediately.
Related Articles
-
The new guidance is intended to establish confidence in automation used for production or quality assurance systems and describe various methods and testing activities that may be applied to establish computer software assurance and meet regulatory software validation requirements.
-
Unauthorized access could allow an attacker to take full control of the host operating system.
-
The recently announced “Refuse to Accept Policy” signed into law under section 524B of the Federal Food, Drug, and Cosmetic Act (FD&C Act) gives the FDA more traction to encourage the medical device manufacturing industry to utilize software bills of…
-
The guidance is intended to clarify the FDA’s approach for referencing the terms “device” and “counterfeit device” in FDA documents, as well as how the agency intends to interpret existing references to section 201(h) of the FD&C Act in guidance,…
