PT-2011-4421 · Medtronic · Medtronic Paradigm
Jay Radcliffe
·
Published
2011-09-02
·
Updated
2017-08-29
·
CVE-2011-3386
CVSS v2.0
4.0
Medium
| Vector | AV:N/AC:H/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Medtronic Paradigm wireless insulin pump versions 512, 522, 712, and 722
Description
The issue allows remote attackers to modify the delivery of an insulin bolus dose, potentially causing adverse human health effects. This can be achieved via unspecified vectors involving wireless communications, provided the attacker has knowledge of the device's serial number. It was demonstrated by Jerome Radcliffe at the Black Hat USA conference in August 2011. The vendor has disputed the severity, stating that the risk of manipulation is extremely low and that users could detect unauthorized tones on the insulin pump and intervene.
Recommendations
For Medtronic Paradigm wireless insulin pump versions 512, 522, 712, and 722, consider restricting access to the device's serial number to minimize the risk of exploitation. As a temporary workaround, users should be vigilant for tones on the insulin pump that weren't intentionally programmed and intervene accordingly. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Medtronic Paradigm