CVE-2022-32537
A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is being paired with other system components.
Does this matter?
Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is being paired with other system components. Exploitation requires nearby wireless signal proximity with the patient and the device; advanced technical knowledge is required for exploitation. Please refer to the Medtronic Product Security Bulletin for guidance
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.33% probability · 26th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-693
- Affected
- medtronic/guardian link 2 transmitter mmt-7730 firmware · medtronic/guardian link 2 transmitter mmt-7731 firmware · medtronic/guardian link 2 transmitter mmt-7738 firmware · medtronic/guardian link 2 transmitter mmt-7775 firmware · medtronic/guardian link 3 transmitter mmt-7810 firmware · medtronic/guardian link 3 transmitter mmt-7811 firmware · medtronic/minimed 620g mmt-1750 firmware · medtronic/minimed 630g mmt-1715 firmware · medtronic/minimed 630g mmt-1754 firmware · medtronic/minimed 630g mmt-1755 firmware · medtronic/minimed 640g mmt-1711 firmware · medtronic/minimed 640g mmt-1712 firmware · medtronic/minimed 640g mmt-1751 firmware · medtronic/minimed 640g mmt-1752 firmware · medtronic/minimed 670g mmt-1740 firmware · medtronic/minimed 670g mmt-1741 firmware · medtronic/minimed 670g mmt-1742 firmware · medtronic/minimed 670g mmt-1760 firmware · medtronic/minimed 670g mmt-1761 firmware · medtronic/minimed 670g mmt-1762 firmware · +8 more
- Source
- security@medtronic.com
References
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-22-263-01
- https://www.medtronic.com/en-us/e/product-security/security-bulletins/minimed-600-series-communication-issue.html
- https://global.medtronic.com/xg-en/product-security/security-bulletins/minimed-600-series-communication-issue.htmlMitigation, Vendor Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-263-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.