PT-2018-1431 · Medtronic · Medtronic Mycarelink Patient Monitor

Billy Rios + 2 · Publicado 2018-08-07 · Atualizado 2026-05-19 · CVE-2018-10626

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:A/AC:M/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Medtronic MyCareLink Patient Monitor versions 24950 and 24952

Description The issue is related to insufficient data authentication in the Medtronic MyCareLink Patient Monitor. This could allow a remote attacker to upload arbitrary information to the Medtronic CareLink network. An attacker would need to obtain per-product credentials from the monitor and paired implantable cardiac device information to potentially upload invalid data.

Recommendations For Medtronic MyCareLink Patient Monitor versions 24950 and 24952, consider restricting access to the update service until a patch is available. As a temporary workaround, ensure that only authorized personnel have access to per-product credentials and implantable cardiac device information to minimize the risk of exploitation.

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

BDU:2018-00980

CVE-2018-10626

Produtos afetados

Medtronic Mycarelink Patient Monitor

Referências · 10

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2018/icsma-18-219-01.json · Nota
• https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html · Nota
• https://bdu.fstec.ru/vul/2018-00980 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 · Nota
• https://cisa.gov/news-events/ics-medical-advisories/icsma-18-219-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-10626 · Nota de Segurança
• https://t.me/cveNotify/164030 · Publicação no Telegram
• http://securitylab.ru/news/494961.php · Nota
• https://t.me/cveNotify/164018 · Publicação no Telegram
• http://securityfocus.com/bid/105042 · Nota