The Recall Desk
HighFDA (Devices)·Z-0444-2022·Announced 2022-01-05

Catalys Precision Laser System recalled for remote code execution vulnerability

AMO Manufacturing is recalling Catalys Precision Laser Systems due to a Windows Print Spooler vulnerability that could allow unauthorized remote code execution with system privileges.

What this means for you

Real risk of harm even if no illness or injury has been reported yet. Stop using the product and follow the agency's guidance.

Our severity reasoning: This is an FDA Class II recall for a remote code execution vulnerability that could allow unauthorized system access and data compromise. However, no illnesses, injuries, or actual exploitation have been reported, and the hazard is theoretical rather than already-realized, placing this at High severity rather than Severe.

Plain-English summary

AMO Manufacturing USA, LLC is recalling Catalys Precision Laser Systems due to a remote code execution vulnerability. Affected models include Catalys-U, Catalys-I, Catalys-C, and Catalys Precision Laser System No Bed models 0160-6020 and 0160-6010, with approximately 546 units distributed.

The recalled systems contain a vulnerability in the Microsoft Windows Print Spooler service. When the Print Spooler service is enabled, the vulnerability could be exploited to run arbitrary code with SYSTEM-level privileges. Potential exploitation could allow program installation, viewing or modification of data, or creation of new user accounts with full administrative rights.

Users of these laser systems should contact AMO Manufacturing USA, LLC for information about remediation options and should take measures to secure their systems from unauthorized access.

The recalled product

Product
Catalys Precision Laser System, Models: Catalys-U (United States), Catalys-I (International), Catalys-C (China); and Catalys Precision Laser System No Bed, Models: 0160-6020 (United States), 0160-6010 (International)
Manufacturer
AMO Manufacturing USA, LLC
Category
Medical Device — Surgical Laser System
Hazard
  • remote-code-execution
  • privilege-escalation
  • data-compromise

Distribution

Distributed in 47 states:

  • AK
  • AL
  • AR
  • AZ
  • CA
  • CO
  • CT
  • DE
  • FL
  • GA
  • HI
  • IA
  • ID
  • IL
  • IN
  • KS
  • KY
  • LA
  • MA
  • MD
  • ME
  • MI
  • MN
  • MO
  • MS
  • MT
  • NC
  • ND
  • NE
  • NH
  • NJ
  • NM
  • NV
  • NY
  • OH
  • OK
  • OR
  • PA
  • SC
  • SD
  • TN
  • TX
  • UT
  • VA
  • VT
  • WA
  • WI

Related recalls

Same category