PT-2018-1431 · Medtronic · Medtronic Mycarelink Patient Monitor

Billy Rios + 2 · Published 2018-08-07 · Updated 2026-05-19 · CVE-2018-10626

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:A/AC:M/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Medtronic MyCareLink Patient Monitor versions 24950 and 24952

Description The issue is related to insufficient data authentication in the Medtronic MyCareLink Patient Monitor. This could allow a remote attacker to upload arbitrary information to the Medtronic CareLink network. An attacker would need to obtain per-product credentials from the monitor and paired implantable cardiac device information to potentially upload invalid data.

Recommendations For Medtronic MyCareLink Patient Monitor versions 24950 and 24952, consider restricting access to the update service until a patch is available. As a temporary workaround, ensure that only authorized personnel have access to per-product credentials and implantable cardiac device information to minimize the risk of exploitation.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2018-00980

CVE-2018-10626

Affected Products

Medtronic Mycarelink Patient Monitor

References · 10

• https://bdu.fstec.ru/vul/2018-00980 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-10626 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2018/icsma-18-219-01.json · Note
• https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 · Note
• https://cisa.gov/news-events/ics-medical-advisories/icsma-18-219-01 · Note
• https://t.me/cveNotify/164030 · Telegram Post
• http://securitylab.ru/news/494961.php · Note
• https://t.me/cveNotify/164018 · Telegram Post
• http://securityfocus.com/bid/105042 · Note