by Carlos E. Castañeda

(CBS SF) — Federal agencies are sounding a warning over a widely-used medical device and its vulnerability to hackers.

The U.S. Food and Drug administration on Friday issued an alert to hospitals not to use the Symbiq Infusion System, a pump that can deliver intravenous medication with a dosage programmed through a hospital’s network.

READ MORE: Michelle Go, Killed In New York Subway Attack, To Be Mourned At San Francisco Chinatown Vigil

The FDA said a hacker could access the device to change the drug dosage, and give the patient either not enough or a lethal amount of medication. So far, there is no documented case of any unauthorized access in a hospital setting, according to the FDA.

The Department of Homeland Security gave a similar warning about the pump’s vulnerability a few days prior. Both cited research from Bay Area cybersecurity expert Billy Rios, who showed attacks could be launched remotely on patients using the device by accessing a hospital’s network.

“By design, you’re allowing it to where someone else can control this thing remotely and do things to the pump, or do things to the device or equipment,” Rios told KPIX 5.

“You could basically log into this device with no user name and no password,” Rios added.

READ MORE: Suspect In November Smash-and-Grab Robbery At High-End Sneaker Store In Santa Clara Arrested

Illinois-based Hospira, the pump’s manufacturer, has discontinued the manufacture and sale of the Symbiq pump and said it was working with hospitals to deploy a software update to prevent remote access to the device.

Millions of Americans use medical devices such as insulin pumps or pacemakers that receive data wirelessly and can theoretically be hacked.

In April, a team of researchers from the University of Washington hacked into a robot designed to carry out surgical procedures, raising fears that a malicious attack could hijack or override a surgeon’s commands.

Bay Area lawmakers have expressed such concerns as far back as 2011 after another cybersecurity expert demonstrated he could hack into an insulin pump he wore as well as other people’s pumps.

“We don’t want someone to have to die in order for them to become a data point in order for us to make a decision,” Rios said.

MORE NEWS: Santa Clara County Receives $22M Project Homekey Grant To Convert Hotel Into Supportive Housing

Carlos E. Castañeda is Senior Editor, News & Social Media for CBS San Francisco and a San Francisco native. You can follow him on Twitter or send him an email.