CVE-2020-25187

Summary

Medtronic MyCareLink Smart 25000 is

 vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event within the MCL Smart Patient Reader software stack. The heap overflow could allow an attacker to remotely execute code on the MCL Smart Patient Reader, potentially leading to control of the device

Affected Software

VendorProductVersion RangeStatus
MedtronicSmart Model 25000 Patient ReaderAll versionsaffected

Weaknesses

  • CWE-122: CWE-122 Heap-based Buffer Overflow

Workarounds

In response to these vulnerabilities, Medtronic has applied additional controls for monitoring and responding to improper use of the MCL Smart Patient Reader:

  • Medtronic has implemented enhanced integrity validation (EIV) technology, which provides early detection and real-time mitigation of known vulnerability exploitation attempts.
  • Medtronic has also implemented advanced detection system technology, which enables device-level logging and monitoring of all device activity and behavior.

Medtronic recommends that users take additional defensive measures to minimize risk. Specifically, users should:

  • Maintain good physical control over home monitors. * This includes only using home monitors in private environments such as a home, apartment, or otherwise physically controlled environment.

  • Use only home monitors obtained directly from your healthcare provider or a Medtronic representative.

  • Patients should ensure that the operating system of their mobile phone is updated to the latest version of the available Android or Apple iOS operating system.

Report any concerning behavior regarding these products to your healthcare provider or a Medtronic representative.

ADP Enrichment

CVE Program Container

Additional References

References