The Department of Homeland Security’s (DHS) Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) issued an advisory announcing that version 5.0 of Hospira’s LifeCare PCA Infusion System was found vulnerable to remotely exploitable bugs.

The Infusion Pump device was discovered to have an improper authorization flaw, along with insufficient data authenticity verification. According to ICS-CERT, the device allows unauthorized users to modify configurations within the infusion pump. Because of the system’s vulnerability to t verification, unauthorized sources could upload drug libraries, software updates, and configuration changes to the device.

As a precaution, the DHS advised device owners to carry out prevention safety measures such as closing unused ports like Port 20/FTP and Port 23/TELNET, layering physical and logical security within environments operating medical devices, and isolating the infusion pump from the internet and untrusted systems.

“When remote access is required, use secure methods, such as VPNs, recognizing that VPNs may have vulnerabilities and should be updated to the most current version available,” the advisory said. “Also recognize that VPN is only as secure as the connected devices.”

ICS-CERT also recommended that infusion pump owners produce MD5 checksums of key files to identify any unauthorized changes.

As infusion pump technology continues to advance, it is important for clinicians and health care providers to keep their equipment well-maintained and up-to-date to ensure patient-safety. AIV is an expert in providing IV pump repair services and also offers top-quality refurbished IV pumps, replacement parts, and accessories for leading manufacturers, including Hospira. Learn more about AIV’s full line of products by visiting http://aiv-inc.com/iv-pump-parts-service.html