CVE-2019-10964
An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
- EPSS
- 1.23% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284, CWE-287, CWE-863
- Affected
- medtronic/minimed 508 firmware · medtronic/minimed paradigm 511 firmware · medtronic/minimed paradigm 512 firmware · medtronic/minimed paradigm 712 firmware · medtronic/minimed paradigm 712e firmware · medtronic/minimed paradigm 515 firmware · medtronic/minimed paradigm 715 firmware · medtronic/minimed paradigm 522 firmware · medtronic/minimed paradigm 722 firmware · medtronic/minimed paradigm 522k firmware · medtronic/minimed paradigm 722k firmware · medtronic/minimed paradigm 523 firmware · medtronic/minimed paradigm 723 firmware · medtronic/minimed paradigm 523k firmware · medtronic/minimed paradigm 723k firmware · medtronic/minimed paradigm veo 554 firmware · medtronic/minimed paradigm veo 754 firmware · medtronic/minimed paradigm veo 554cm firmware · medtronic/minimed paradigm veo 754cm firmware
- Source
- ics-cert@hq.dhs.gov
References
- http://www.securityfocus.com/bid/108926Third Party Advisory, VDB Entry
- https://global.medtronic.com/xg-en/product-security/security-bulletins/minimed-508-paradigm.html
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-178-01
- http://www.securityfocus.com/bid/108926Third Party Advisory, VDB Entry
- https://www.us-cert.gov/ics/advisories/icsma-19-178-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.