The Cybersecurity and Infrastructure Security Agency (CISA) has released an urgent security alert to healthcare providers that their Hillrom Welch Allyn cardio products could contain a critical vulnerability susceptible to attack. The flaw, tracked as CVE-2021-43935, is an authentication bypass vulnerability that if exploited, could allow a remote attacker to undermine standard authentication in-lieu of alternative paths. Specifically, this flaw exists in the Welch Allyn Q-Stress and X-Scribe Cardiac Stress Testing Systems, Diagnostic Cardiology Suite, Vision Express, H-Scribe Holter Analysis System, R-Scribe Resting ECG System, and Connex Cardio. The vulnerability stems from susceptible devices being configured for Single Sign-on (SSO), which is where the authentication flaw comes into play, enabling the application to accept a manual Active Directory (AD) account which wouldn’t require a password. This would allow a remote attacker to attain full application access with administrator privileges. According to researchers, this vulnerability hasn’t been exploited in-the-wild, and although a formal security patch has not been implemented, there is a manual workaround. First, customers must ensure they are running the most up-to-date firmware, and SSO should be disabled in the Modality Manager Configuration settings. Attacks on the health care industry are becoming more prevalent, and the Ankura CTIX will continue to provide our readers with actionable intelligence