Description
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
InterSystems IRIS for Health
Default version status: unaffected
2026.2.0.221affected2026.1.0.235affected2025.3.0.226affected
References
- https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist ↗
- https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver ↗
- https://wrc.intersystems.com ↗
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01 ↗
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json ↗