CVE-2020-27252

Summary

Medtronic MyCareLink Smart 25000 is

vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited, an attacker could remotely execute code on the MCL Smart Patient Reader device, leading to control of the device.

Affected Software

VendorProductVersion RangeStatus
MedtronicSmart Model 25000 Patient ReaderAll versionsaffected

Weaknesses

  • CWE-367: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Workarounds

In response to these vulnerabilities, Medtronic has applied additional controls for monitoring and responding to improper use of the MCL Smart Patient Reader:

  • Medtronic has implemented enhanced integrity validation (EIV) technology, which provides early detection and real-time mitigation of known vulnerability exploitation attempts.
  • Medtronic has also implemented advanced detection system technology, which enables device-level logging and monitoring of all device activity and behavior.

Medtronic recommends that users take additional defensive measures to minimize risk. Specifically, users should:

  • Maintain good physical control over home monitors. * This includes only using home monitors in private environments such as a home, apartment, or otherwise physically controlled environment.

  • Use only home monitors obtained directly from your healthcare provider or a Medtronic representative.

  • Patients should ensure that the operating system of their mobile phone is updated to the latest version of the available Android or Apple iOS operating system.

Report any concerning behavior regarding these products to your healthcare provider or a Medtronic representative.

ADP Enrichment

CVE Program Container

Additional References

References