CVE-2018-10596
mediumpriority · track · 32EPSS 0.013 · 71 %ileEUUSEPSS · scored 2026-10-26
Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this virtual private network before downloading updates. The affected products initially establish an encapsulated IP-based VPN connection to a Medtronic-hosted update network. Once the VPN is established, it makes a request to a HTTP (non-TLS) server across the VPN for updates, which responds and provides any available updates. The programmer-side (client) service responsible for this HTTP request does not check to ensure it is still connected to the VPN before making the HTTP request. Thus, an attacker could cause the VPN connection to terminate (through various methods and attack points) and intercept the HTTP request, responding with malicious updates via a man-in-the-middle attack. The affected products do not verify the origin or integrity of these updates, as it insufficiently relied on the security of the VPN. An attacker with remote network access to the programmer could influence these communications.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixed2090 CareLink Programmercisa_csaf_ot
After additional review and risk evaluation of the affected products, Medtronic has disabled the network-based software update mechanism, including both the VPN and the HTTP subservices, as an immediate security mitigation. Users should not attempt to update the affected products over the network as this update mechanism is vulnerable to the attack described in section 4.2.3. Medtronic will continue to implement and deploy increased security protections and mitigations to address the vulnerabilities in this advisory.
- Fixed29901 Encore Programmercisa_csaf_ot
After additional review and risk evaluation of the affected products, Medtronic has disabled the network-based software update mechanism, including both the VPN and the HTTP subservices, as an immediate security mitigation. Users should not attempt to update the affected products over the network as this update mechanism is vulnerable to the attack described in section 4.2.3. Medtronic will continue to implement and deploy increased security protections and mitigations to address the vulnerabilities in this advisory.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.2–8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
- medtronic 2090 carelink programmer firmwareall versionsnvdUScpe:2.3:o:medtronic:2090_carelink_programmer_firmware:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSMA-18-058-01Medtronic 2090 Carelink Programmer Vulnerabilities (Update C)2018-02-27icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may allow an attacker with physical access to a 2090 Programmer to obtain per-product credentials to the software deployment network. These credentials grant access to the software deployment network, but access is limited to read-only versions of device software applications.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- http://www.nsfocus.net/vulndb/47493cnnvd
- https://global.medtronic.com/xg-en/product-security/security-bulletins/carelink-2090-29901.htmlcnnvd
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-01cnnvd
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-058-01cnnvd
- https://www.us-cert.gov/ics/advisories/ICSMA-18-058-01cnnvd
- https://global.medtronic.com/xg-en/product-security/security-bulletins/carelink-2090-29901.htmlenisa_euvd
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-058-01enisa_euvd
- https://global.medtronic.com/xg-en/product-security/security-bulletins/carelink-2090-29901.htmlnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan