Medical Device Aberrometer Systems Affected by Remote Code Execution Vulnerability
AMO Manufacturing's iDesign aberrometer systems (711 units, Models G300 and G301) are vulnerable to remote code execution through the Windows Print Spooler service. An attacker could run arbitrary code with SYSTEM privileges to install programs, access or delete data, or create accounts.
What this means for you
Real risk of harm even if no illness or injury has been reported yet. Stop using the product and follow the agency's guidance.
Our severity reasoning: This is an FDA Class II medical device recall for a remote code execution vulnerability. The source text does not report any illnesses, injuries, or confirmed incidents of exploitation. Per the rubric, high-risk medical device hazards without reported injuries classify as High (3).
Plain-English summary
AMO Manufacturing USA, LLC is recalling 711 units of iDesign aberrometer and precision laser systems (Models G300 and G301) due to a remote code execution vulnerability affecting the Windows Print Spooler service. The vulnerability allows improperly performed privileged file operations on the devices.
An attacker could exploit this vulnerability to run arbitrary code with SYSTEM-level privileges. This could allow program installation, viewing or changing data, deleting data, or creation of new user accounts with full administrative rights.
The affected units have been distributed across the United States and internationally to countries including Canada, Mexico, and numerous others. These systems include Model G300 running Windows XP and Model G301 running Windows 7 Embedded System. Healthcare providers currently using these systems should contact AMO Manufacturing USA, LLC for information about remediation options.
The recalled product
- Product
- iDesign, Model - G300: System AWS (International), System AWS (China), Advanced WaveScan Studio (United States); iDesign Refractive Studio Aberrometer (International) and (United States), Model: G301
- Manufacturer
- AMO Manufacturing USA, LLC
- Affected units
- 711
Is your product affected?
Check your packaging against the codes below. If any of them match, the product is part of this recall.
Lot numbers (1)
- G300 with Windows XP. G301 with Windows 7 Embedded System.
Distribution
Part of a larger recall action
This product is one of 2 recalled by AMO Manufacturing USA, LLC under a single FDA (Devices) recall action. The agency files each product separately, so the size of the action is not visible from this page alone.
See all 2 products in this recall →Related recalls
Same manufacturer · AMO Manufacturing USA, LLC
See all →- HighCatalys Precision Laser System recalled for remote code execution vulnerability
FDA (Devices) · 2022-01-05
Same hazard · remote code execution
See all →- HighFlow-i C20 Anesthesia System cybersecurity vulnerability could enable remote attacks
FDA (Devices) · 2024-02-14
- HighFlow-c Anesthesia System cybersecurity vulnerability in 14 units
FDA (Devices) · 2024-02-14
- HighAnesthesia System Cybersecurity Vulnerability Poses Denial of Service Risk
FDA (Devices) · 2024-02-14
- HighFlow-i C40 Anesthesia System Recalled for Cybersecurity Vulnerability
FDA (Devices) · 2024-02-14
- HighFlow-e Anesthesia System Model 6887900 Cybersecurity Vulnerability Recall
FDA (Devices) · 2024-02-14