medium4.4
CVE-2018-10626
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded.
Impact
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLink network.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Medtronic | Mycarelink 24952 Patient Monitor Firmware | All versions |
| Medtronic | Mycarelink 24950 Patient Monitor Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/105042
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2018/icsma-18-219-01.json
- https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-219-01
- http://www.securityfocus.com/bid/105042
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01