BlackBerry announces cyber threat to operating system for medical devices

BlackBerry yesterday announced a set of cyber vulnerabilities in its QNX Real Time Operating System for medical devices and other products, which a remote attacker could exploit to cause a denial-of-service condition or execute arbitrary code on affected devices. It said there are no known workarounds for the vulnerability. The U.S. Cybersecurity and Infrastructure Security Agency recommends applying patches as soon as they are available from BlackBerry. 

“Because many affected devices include safety-critical devices, exploitation of this vulnerability could result in a malicious actor gaining control of sensitive systems, possibly leading to increased risk of damage to infrastructure or critical functions,” CISA said.

John Riggi, AHA senior advisor for cybersecurity and risk, said, “This cyber vulnerability is significant since it is present in medical devices and may, if successfully exploited, preclude availability or cause malfunction of the device, or pose a risk to patient care. If at all possible, it is recommended that affected devices be disconnected from internal networks and the internet until a patch becomes available.”

For more on this or other cyber and risk issues, contact Riggi at jriggi@aha.org.