CVE-2018-8868

Summary

Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality.

Affected Software

Weaknesses

• CWE-749: CWE-749

Workarounds

Medtronic recommends users take additional defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:

• Maintain good physical controls over the home monitor as the best mitigation to these vulnerabilities.  
• Only use home monitors obtained directly from their healthcare provider or a Medtronic representative to ensure integrity of the system.
• Report any concerning behavior regarding their home monitor to their healthcare provider or a Medtronic representative.

Medtronic has released additional patient focused information, at the following location:

https://www.medtronic.com/security

ADP Enrichment

CVE Program Container

Additional References

• https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01

References

• https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-6-28-18.html
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01

• ←Previous
• Next→