PT-2018-1434 · Medtronic · Paradigm Revel+2

Billy Rios + 2 · Published 2018-08-08 · Updated 2019-10-09 · CVE-2018-10634

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Medtronic MMT 508 MiniMed insulin pump versions 508 through 751 Medtronic MMT 522 Paradigm REAL-TIME Medtronic MMT 523 Paradigm Revel Medtronic MMT 523K Paradigm Revel Medtronic MMT 551 MiniMed 530G Medtronic MMT 722 Paradigm REAL-TIME Medtronic MMT 723 Paradigm Revel Medtronic MMT 723K Paradigm Revel Medtronic MMT 751 MiniMed 530G

Description The issue is related to the transmission of sensitive information in cleartext between the insulin pump and wireless accessories. This could allow a sufficiently skilled attacker to capture these transmissions and extract sensitive information, such as device serial numbers.

Recommendations For Medtronic MMT 508 MiniMed insulin pump, consider disabling wireless communication until a patch is available. For Medtronic MMT 522 Paradigm REAL-TIME, restrict access to the device to minimize the risk of exploitation. For Medtronic MMT 523 Paradigm Revel, avoid using the device's wireless features until the issue is resolved. For Medtronic MMT 523K Paradigm Revel, consider implementing additional security measures to protect against eavesdropping. For Medtronic MMT 551 MiniMed 530G, disable the wirelessTransmission() function until a patch is available. For Medtronic MMT 722 Paradigm REAL-TIME, restrict access to the device's serial number to prevent exploitation. For Medtronic MMT 723 Paradigm Revel, avoid using the device's serial number in cleartext until the issue is resolved. For Medtronic MMT 723K Paradigm Revel, consider implementing encryption for wireless transmissions. For Medtronic MMT 751 MiniMed 530G, restrict access to the device's wireless accessories to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2018-00983

CVE-2018-10634

Affected Products

Minimed 530G

Paradigm Real-Time

Paradigm Revel

References · 6

• https://bdu.fstec.ru/vul/2018-00983 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-10634 · Security Note
• https://global.medtronic.com/xg-en/product-security/security-bulletins/minimed.html · Note
• https://securitylab.ru/news/494960.php · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-02 · Note
• http://securityfocus.com/bid/105044 · Note