Cyber

What changed

NextGen Healthcare's Mirth Connect prior to version 4.4.1 contains a critical vulnerability that permits unauthenticated remote code execution. This issue arises from an incomplete patch for CVE-2023-37679, leaving systems exposed to potential exploitation.

Organizations using affected versions should assess their deployments immediately to mitigate risks associated with this vulnerability.

Who is affected

The vulnerability impacts various stakeholders relying on Mirth Connect for healthcare data integration and management.

Affected parties include healthcare providers, software developers utilizing Mirth Connect, and organizations involved in health information exchange.

• NextGen Healthcare Mirth Connect versions before 4.4.1
• Healthcare providers using Mirth Connect for data integration
• Software developers leveraging Mirth Connect APIs
• Organizations engaged in health information exchange

What to do

It is crucial for organizations to upgrade to Mirth Connect version 4.4.1 or later to eliminate the risk posed by this vulnerability. Additionally, a review of security practices surrounding data handling and integration should be conducted.

Monitoring for unusual activity and implementing additional security measures can help mitigate the risk of potential exploitation.

• Upgrade to Mirth Connect version 4.4.1 or later
• Conduct a security review of data handling practices
• Monitor systems for unusual activity
• Implement additional security measures as necessary

What changed

VMware has disclosed an out-of-bounds write vulnerability in vCenter Server, specifically in the implementation of the DCERPC protocol. This flaw could allow an attacker with network access to exploit the vulnerability and execute arbitrary code remotely.

• The vulnerability is categorized as critical due to its potential impact.
• Exploitation could lead to unauthorized access and control over affected systems.
• Immediate attention is required to mitigate risks associated with this vulnerability.

Who is affected

Organizations using VMware vCenter Server are at risk, particularly those with network exposure to the service. The following groups should take note:

IT administrators and security teams managing VMware environments need to be aware of this vulnerability.

• VMware vCenter Server users across various industries.
• Organizations with exposed network configurations that allow access to vCenter Server.
• Cloud service providers utilizing vCenter Server for virtualization management.

What to do

Organizations should assess their exposure to this vulnerability and take appropriate actions to mitigate risks. Recommended steps include:

Implementing network segmentation to limit access to vCenter Server from untrusted networks.

• Review and apply any available patches or updates from VMware.
• Monitor network traffic for any suspicious activity related to vCenter Server.
• Educate staff about the risks associated with this vulnerability and best practices for securing their environments.