Medtronic MyCareLink 24950 Patient Monitor (Update A)
Successful exploitation of these vulnerabilities may allow an attacker with physical access to obtain per-product credentials that are utilized to authenticate data uploads and encrypt data at rest. Additionally, an attacker with access to a set of these credentials and additional identifiers can upload invalid data to the Medtronic CareLink network.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-10626US | medium4.4OT elevated | — | ||
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An
attacker who obtains per-product credentials from the… | ||||
| CVE-2018-10622US | high7.1 | — | ||
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication. | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSMA-18-219-01 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSMA-18-219-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (4)
- Mitigation24950 MyCareLink Monitor
Maintain good physical control over the home monitor.
- Mitigation24950 MyCareLink Monitor
Maintain good physical control over the home monitor.
- Mitigation24952 MyCareLink Monitor
Maintain good physical control over the home monitor.
- Mitigation24952 MyCareLink Monitor
Maintain good physical control over the home monitor.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan