CVE-2019-10964
An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
- EPSS
- 1.23% probability · 69th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-284, CWE-287, CWE-863
- Affected
- medtronic/minimed 508 firmware · medtronic/minimed paradigm 511 firmware · medtronic/minimed paradigm 512 firmware · medtronic/minimed paradigm 712 firmware · medtronic/minimed paradigm 712e firmware · medtronic/minimed paradigm 515 firmware · medtronic/minimed paradigm 715 firmware · medtronic/minimed paradigm 522 firmware · medtronic/minimed paradigm 722 firmware · medtronic/minimed paradigm 522k firmware · medtronic/minimed paradigm 722k firmware · medtronic/minimed paradigm 523 firmware · medtronic/minimed paradigm 723 firmware · medtronic/minimed paradigm 523k firmware · medtronic/minimed paradigm 723k firmware · medtronic/minimed paradigm veo 554 firmware · medtronic/minimed paradigm veo 754 firmware · medtronic/minimed paradigm veo 554cm firmware · medtronic/minimed paradigm veo 754cm firmware
- Source
- ics-cert@hq.dhs.gov
EPSS 1.2% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://www.securityfocus.com/bid/108926Third Party Advisory, VDB Entry
- https://global.medtronic.com/xg-en/product-security/security-bulletins/minimed-508-paradigm.html
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-178-01
- http://www.securityfocus.com/bid/108926Third Party Advisory, VDB Entry
- https://www.us-cert.gov/ics/advisories/icsma-19-178-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.