Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers
As part of the intended functionality of this device, it may store protected health information (PHI) or personally identifiable information (PII). Successful exploitation of the vulnerability may allow an attacker with physical access to an affected programmer to access PHI or PII stored on the device.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-18984US | medium4.6OT elevated | — | ||
Medtronic CareLink and Encore Programmers
do not encrypt or do not sufficiently encrypt sensitive
PII and PHI information while at rest . | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSMA-18-347-01 JSONself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (3)
- Fixed29901 Encore Programmer
All affected programmers allow for the manual deletion of programmer-generated reports, which could contain PHI/PII. Medtronic recommends users delete these reports when no longer needed and prior to any disposition of the programmer.
- FixedCareLink 2090 Programmer
All affected programmers allow for the manual deletion of programmer-generated reports, which could contain PHI/PII. Medtronic recommends users delete these reports when no longer needed and prior to any disposition of the programmer.
- FixedCareLink 9790 Programmer
All affected programmers allow for the manual deletion of programmer-generated reports, which could contain PHI/PII. Medtronic recommends users delete these reports when no longer needed and prior to any disposition of the programmer.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan