Agency classClass IIOur severity:High FDA (Devices)·Z-0989-2024·Announced 2024-02-14

Flow-i C40 Anesthesia System Recalled for Cybersecurity Vulnerability

Getinge's Flow-i C40 Anesthesia System (model 6677400) contains a potential cybersecurity vulnerability allowing remote login attacks that could result in denial of service, system tampering, or remote code execution.

The agency’s classification

FDA (Devices): Class II

Class II is a situation in which use of or exposure to a violative product may cause temporary or medically reversible adverse health consequences, or where the probability of serious adverse health consequences is remote.

This is the agency’s own classification, taken from its notice. The severity score below is our assessment, not the agency’s. How recall classes work

What this means for you

Our assessment, not the agency’s: severity 3/5 (High).

Real risk of harm even if no illness or injury has been reported yet. Stop using the product and follow the agency's guidance.

Our severity reasoning: This is a Class II medical device recall for a risk-of-harm product (anesthesia system) where a cybersecurity vulnerability could interfere with critical patient care functions. No injuries, illnesses, or actual incidents have been reported. Per the rubric, risk-of-harm products where injury has not yet been reported score as High (3).

Plain-English summary

Getinge Usa Sales Inc is recalling the Flow-i C40 Anesthesia System, model 6677400, due to a potential cybersecurity vulnerability. The vulnerability could allow unauthorized remote access to the system via remote login, potentially leading to denial of service attacks, tampering with system functions, or remote code execution.

Affected anesthesia systems include 16 units distributed across the United States to facilities in Alabama, Arizona, Arkansas, California, Colorado, Florida, Georgia, Indiana, Massachusetts, Michigan, Missouri, New York, Ohio, Oregon, Pennsylvania, Texas, Virginia, Washington, Washington D.C., and West Virginia. The recalled units are identified by specific serial numbers: 5204, 5205, 5206, 5207, 5208, 5209, 5210, 5211, 7185, 7982, 7983, 8426, 8427, 8428, 8445, and 8446.

Healthcare facilities using this anesthesia system should contact Getinge Usa Sales Inc immediately to determine if their system is affected and for guidance on remediation measures.

The recalled product

Product: Flow-i C40 Anesthesia System, model 6677400
Manufacturer: Getinge Usa Sales Inc
Category: Medical Device — Anesthesia Equipment
Hazard: cybersecurity-vulnerability
denial-of-service
remote-code-execution
tampering
Affected units: 16

Is your product affected?

Check your packaging against the codes below. If any of them match, the product is part of this recall.

Lot numbers (17)

UDI-DI: 07325710001318
serial numbers (US): 5204
5205
5206
5207
5208
5209
5210
5211
7185
7982
7983
8426
8427
8428
8445
8446.

Distribution

Distributed nationwide across the United States.

The notice also names 20 states specifically:

Part of a larger recall action

This product is one of 5 recalled by Getinge Usa Sales Inc under a single FDA (Devices) recall action. The agency files each product separately, so the size of the action is not visible from this page alone.

See all 5 products in this recall →

Same manufacturer · Getinge Usa Sales Inc

See all →

Severe
Sevoflurane Vaporizer Quik-Fil Recalled Due to Chemical Degradation Risk
FDA (Devices) · 2025-02-19
High
Operating Table May Stop Unexpectedly During Surgery Due to Control Error
FDA (Devices) · 2024-11-20
Moderate
Getinge MEERA CL Mobile Operating Table Recalled for Intermittent Movement Errors
FDA (Devices) · 2024-11-20
High
MEERA CL Mobile Operating Table Control Malfunction Recall
FDA (Devices) · 2024-11-20
Moderate
Getinge MEERA CL mobile operating table recalled for sporadic movement errors
FDA (Devices) · 2024-11-20

Same hazard · cybersecurity vulnerability