The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Medical Equipment
Breach intelligence, attack campaigns, and threat reports targeting the Medical Equipment sector.
Explore Other Sectors
Medical Equipment Threat Reports
Critical Bluetooth Vulnerability Exposes WHILL Medical Wheelchairs
In December 2025, a critical IoT vulnerability (CVE-2025-14346) was disclosed in WHILL Model C2 Electric Wheelchairs and Model F Power Chairs, widely used in healthcare and public health sectors. Researchers discovered that these devices failed to enforce authentication for Bluetooth connections, enabling attackers within physical range to pair, take full control, issue movement commands, bypass safety restrictions, and alter configuration profiles with no user credentials required. The issue impacted all device versions, prompting emergency firmware mitigations from WHILL Inc. to restrict unauthorized access and manipulation. This incident underscores urgent risks associated with the growing attack surface in medical IoT and connected healthcare devices. Increasing reliance on wireless interfaces heightens exposure to exploitation, mandating stronger security and authentication measures as the threat landscape evolves.
8 months ago
Kill Chain
Varex Imaging 2025: Privilege Escalation Vulnerability in Dental Imaging Software
In December 2025, Varex Imaging disclosed a critical privilege escalation vulnerability (CVE-2024-22774, CVSS v4 8.5) affecting its Panoramic Dental Imaging Software (versions prior to 6.6.1.490). The flaw, caused by an uncontrolled search path element (CWE-427) in the SDK, could enable a standard user to gain NT Authority/SYSTEM privileges through DLL hijacking. While the vulnerability cannot be exploited remotely and no active exploitation has been reported, successful compromise could give attackers unrestricted system access in affected healthcare environments, with the potential to disrupt or manipulate sensitive imaging processes. This incident underscores the persistent risks of local privilege escalation vulnerabilities in healthcare software, especially where operational technology and patient systems converge. With increasing regulatory requirements and a rising focus on vertical-specific threats, incidents like this highlight the urgent need for robust patch management, secure software development practices, and vigilant network segmentation in healthcare environments.
8 months ago
Kill Chain
Critical GDCM Vulnerability Risks Healthcare Medical Imaging Workflows
In December 2025, a significant vulnerability was disclosed in the Grassroots DICOM (GDCM) library, a critical open-source imaging component widely used in healthcare systems worldwide. Identified as CVE-2025-11266, this out-of-bounds write vulnerability could be triggered by simply opening a specially-crafted DICOM file, potentially crashing affected applications such as SimpleITK and medInria. The flaw, present in versions GDCM 3.0.24 and earlier, allows for denial-of-service and partial data and integrity impacts, increasing operational risk for healthcare environments that rely on medical imaging interoperability. This incident highlights the persistent risk posed by vulnerable third-party libraries in regulated industries like healthcare. The rise in supply chain threats and software dependencies magnifies the urgency for organizations to maintain rigorous patching practices and robust segmentation, as attackers increasingly target widely-deployed open-source components to disrupt critical services.
8 months ago
Kill Chain
Mirion Medical 2025: Critical Vulnerabilities in NMIS BioDose Software Threaten Healthcare Security
In December 2025, Mirion Medical disclosed multiple high-severity vulnerabilities affecting its EC2 Software NMIS BioDose product, versions prior to 23.0. These flaws—incorrect permission assignments, use of hard-coded credentials, and client-side authentication weaknesses—could be exploited by attackers to gain unauthorized access, elevate privileges, manipulate executables, steal sensitive medical data, or execute arbitrary code. Impacting the healthcare and public health sectors globally, these vulnerabilities pose critical operational and patient-data risks, especially in environments with networked installations and exposed Microsoft SQL Server databases. No active exploitation has yet been reported, but CISA urges urgent mitigation measures due to the vulnerabilities’ remote exploitability and low attack complexity. This incident highlights intensifying regulatory scrutiny on medical device security as threat actors increasingly target healthcare systems for sensitive patient data and intellectual property. The vulnerabilities in Mirion’s product underscore persistent gaps in authentication and privilege controls—a growing concern amid adoption of connected medical technologies and regulatory frameworks such as HIPAA and NIST.
8 months ago
Kill Chain
Critical DoS Flaw in NIHON KOHDEN CNS-6201 Exposes Legacy Healthcare Systems
In October 2025, a critical security vulnerability (CVE-2025-59668) was disclosed in the NIHON KOHDEN Central Monitor CNS-6201—a medical device used globally in healthcare environments. The flaw, a NULL pointer dereference triggered by a specially crafted UDP packet, allows attackers to remotely cause a denial-of-service (DoS) condition, resulting in abnormal termination of the monitoring process. Exploitation requires no authentication as long as the device is network-accessible. Affected models are end-of-support, placing healthcare environments at heightened risk if legacy equipment remains unsegmented or exposed. This exposure highlights continuing challenges associated with legacy medical devices, the urgency of network segmentation, and the importance of proactive vulnerability management in healthcare. Similar technique trends surrounding unauthenticated DoS vulnerabilities in critical infrastructure increase regulatory, patient-safety, and operational risk considerations.
8 months ago
Kill Chain
SimonMed Data Breach Exposes Over 1.2 Million Patient Records in 2024
In January 2024, SimonMed Imaging, a major U.S. provider of diagnostic medical imaging, disclosed a data breach impacting over 1.2 million patients. The incident involved unauthorized access to internal systems, which allowed attackers to exfiltrate sensitive health and personal information—including names, birthdates, contact information, health insurance and medical data. The breach was discovered during routine security monitoring, after which SimonMed implemented containment measures and engaged third-party forensics. Regulatory authorities and affected individuals were promptly notified, with the company offering support and identity protection services where relevant. This breach underscores the persistent targeting of healthcare organizations due to the high value of medical data, as well as regulatory scrutiny around the protection of patient information. It highlights the growing sophistication of data exfiltration tactics, emphasizing the critical need for robust east-west security controls, encrypted traffic, and rapid anomaly detection within healthcare IT environments.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports