CVE-2020-25183

Summary

Medtronic MyCareLink Smart 25000 contains

an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader and the Medtronic MyCareLink Smart mobile app is vulnerable to bypass. This vulnerability enables an attacker to use another mobile device or malicious application on the patient’s smartphone to authenticate to the patient’s Medtronic Smart Reader, fooling the device into believing it is communicating with the original Medtronic smart phone application when executed within range of Bluetooth communication.

Affected Software

VendorProductVersion RangeStatus
MedtronicSmart Model 25000 Patient ReaderAll versionsaffected

Weaknesses

  • CWE-287: CWE-287 Improper Authentication

Workarounds

In response to these vulnerabilities, Medtronic has applied additional controls for monitoring and responding to improper use of the MCL Smart Patient Reader:

  • Medtronic has implemented enhanced integrity validation (EIV) technology, which provides early detection and real-time mitigation of known vulnerability exploitation attempts.
  • Medtronic has also implemented advanced detection system technology, which enables device-level logging and monitoring of all device activity and behavior.

Medtronic recommends that users take additional defensive measures to minimize risk. Specifically, users should:

  • Maintain good physical control over home monitors. * This includes only using home monitors in private environments such as a home, apartment, or otherwise physically controlled environment.

  • Use only home monitors obtained directly from your healthcare provider or a Medtronic representative.

  • Patients should ensure that the operating system of their mobile phone is updated to the latest version of the available Android or Apple iOS operating system.

Report any concerning behavior regarding these products to your healthcare provider or a Medtronic representative.

ADP Enrichment

CVE Program Container

Additional References

References