VulnerabilityModified
CVE-2016-5085
Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof meters by sniffing the network and then engaging in an authentication handshake.
HIGH 7.5EPSS 3.86%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.86%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof meters by sniffing the network and then engaging in an authentication handshake.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 3.86% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-330
- Affected
- animas/onetouch ping firmware
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/884840Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/BLUU-A9SQRSThird Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/93351
- https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pumpMitigation, Technical Description, Third Party Advisory
- https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01
- http://www.kb.cert.org/vuls/id/884840Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/BLUU-A9SQRSThird Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/93351
- https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pumpMitigation, Technical Description, Third Party Advisory
- https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.