Somewhere above the ceiling tiles of most large hospitals, a plastic carrier is moving at speed. It might hold a tube of blood headed for the lab, or a dose a ward needs in the next ten minutes. Clinicians call it "the tube." Few people in the building would call it a computer.
It is one. That makes it a useful test case for security teams. It is a building system that carries clinical material, runs on embedded Linux, and is often maintained by people from outside the hospital.
What PwnedPiper showed
In August 2021, researchers at Armis published PwnedPiper. Armis counted nine vulnerabilities, tracked as eight CVEs, in Swisslog Healthcare's Translogic pneumatic tube system. The system moves "lab specimens, blood products, pathology lab tests, medications, and more." Armis said it is used in over 80% of hospitals in North America. Armis reported the flaws to Swisslog on May 1, 2021.
The headline bugs were not exotic. The Armis white paper describes an open Telnet server on the stations. It accepted logins for two accounts, root and user, and their hard-coded password hashes sat on the device. Armis rated CVE-2021-37160 the most severe: an "unauthenticated, unencrypted, unsigned firmware upgrade." The white paper adds that there is "no cryptographic signature validation of any kind." In plain terms, anyone who could reach a station on the network might log in with a password nobody at the hospital chose. They could then load software the station had no way to check.
CISA's medical advisory ICSMA-21-215-01 gave six of the eight CVEs a CVSS v3 score of 9.8. It scored the firmware flaw 7.5 and listed the system as deployed worldwide. Swisslog's Nexus Control Panel version 7.2.5.7 was, in CISA's words, "reported to fix all vulnerabilities above except CVE-2021-37160." Swisslog's own bulletin for that flaw still lists the fix as "Future Release," target date "TBD." HHS's HC3 sector alert added that older IP-connected stations "are no longer supported by Swisslog."
It did not end in 2021
On November 3, 2026, Swisslog posted a new bulletin, titled "PHP Vulnerabilities." It describes "unauthenticated remote code execution" in its pneumatic tube system software, v7.4.9 and newer, and in ITS TU/Blower Board (Series 1) firmware. The CVSS v4.0 base score is 9.2 (Critical). Swisslog says software versions 7.4.14 and 9.0.7 fix it, alongside a firmware update. These are different components from PwnedPiper, but the lesson is the same: tube systems are software, and software needs a patch owner.
Why the tube matters when it stops
The bigger risk is losing the tube when you need it, not someone stealing a carrier. The American Hospital Association covered PwnedPiper when it came out. Its cybersecurity advisor, John Riggi, described modern tube systems as "highly computerized and network-connected." He warned that a disruption "would have widespread impact on care delivery operations."
That is not hypothetical. The University of Vermont Medical Center was hit by a cyberattack in 2020. Afterward, its lab team wrote that "a networked server 'drives' the pneumatic tube system." Powering that server off during recovery "disabled the tube system." The hospital fell back on "runners" ("literally, people to run the halls"). The authors call the whole episode a 25-day downtime of the hospital's network.
The weak points are identity weak points
Look at PwnedPiper again and most of it is about who, or what, the system trusts. A shared, hard-coded password means every technician and every attacker is the same user. An unsigned firmware path means the device trusts any file that arrives. Vendor maintenance often adds a third weak point: a remote-access route into the building network that the hospital does not fully control.
Guidance has been moving the same way. CISA and the FBI published non-binding Product Security Bad Practices guidance in January 2025. It calls default passwords and "hardcoded credentials" in critical-infrastructure products dangerous, and does the same for products that don't enable MFA by default for administrator accounts. It also names "phishing-resistant MFA." HHS's Cybersecurity Performance Goals list MFA, unique credentials and vendor requirements as essential goals. Asset inventory and network segmentation are enhanced goals. In the EU, NIS2 Article 21 names supply chain security, asset management and, where appropriate, "multi-factor authentication."
What to do, and what to ask
Inventory
Does the tube system appear in your asset inventory, with firmware versions for each station, controller and blower?
Are any stations old enough to be out of vendor support?
Segmentation
Is the tube system on its own network segment, with stations allowed to talk only to the central controller?
Is Telnet, or any other cleartext admin service, blocked?
Procurement and firmware
Does the vendor cryptographically sign firmware, and does the device refuse unsigned images?
Does the vendor publish a security bulletin page, and who at your organization reads it?
Can the vendor confirm there are no hard-coded or shared credentials?
Maintenance access
Does every technician, in-house or vendor, log in with a named account?
Is remote and on-site admin access protected by phishing-resistant MFA, and logged?
Is vendor remote access switched on only for a scheduled job, then off?
Downtime
If the tube stops tonight, who runs specimens and medications, by which routes, and who authorizes it?
Have the lab, pharmacy and facilities teams rehearsed it together?
The tube has been in the ceiling for decades. Treat it as what it now is: a networked system that clinical care depends on, with accounts, firmware and a vendor who needs a way in.
