HSA would like to communicate regarding a recently discovered cybersecurity vulnerability called "5Ghoul." A vulnerability is a weakness in an IT system that can be exploited by an attacker to do a successful attack. They can occur through flaws, features, or user error, then the attackers will look to exploit any of them by often combining one or more flaws to achieve their end goal.
The 5Ghoul is a recently discovered cybersecurity vulnerability that could potentially affect commercial off-the-shelf (COTS) edge devices employing 5G modems. The vulnerabilities may be exploited to continuously launch attacks to drop the connection, freeze the connection that involves manual reboot, or downgrade the 5G connectivity to 4G. This could potentially impact medical device systems that use the affected 5G modems or require a network connection to function. As of December 15, 2023, the vulnerabilities affected 5G modems from Qualcomm and MediaTek.
HSA recommended several actions that should be taken by industry stakeholders along with the manufacturers such as identifying the devices affected by the vulnerabilities, reporting to HSA at HSA_MD_INFO@hsa.gove.sg if there is medical device affected, performing risk assessment of the vulnerabilities, developing risk mitigation plan, and communicating with healthcare institutions and end-users. As for healthcare institutions and end-users, HSA recommended communicating with medical device suppliers and manufacturers.
References: