CVE-2022-32537
mediumpriority · track · 19EPSS 0.003 · 28 %ileEUUSEPSS · scored 2026-10-27
A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is being paired with other system components. Exploitation requires nearby wireless signal proximity with the patient and the device; advanced technical knowledge is required for exploitation. Please refer to the Medtronic Product Security Bulletin for guidance
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedMiniMed 620Gcisa_csaf_ot
Medtronic has identified the following precautions to assist users:
- FixedMiniMed 630Gcisa_csaf_ot
Medtronic has identified the following precautions to assist users:
- FixedMiniMed 640Gcisa_csaf_ot
Medtronic has identified the following precautions to assist users:
- FixedMiniMed 670Gcisa_csaf_ot
Medtronic has identified the following precautions to assist users:
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (37)
Products and version ranges known to be affected.
- medtronic guardian link 2 transmitter mmt-7730 firmwareall versionsnvdUScpe:2.3:o:medtronic:guardian_link_2_transmitter_mmt-7730_firmware:*:*:*:*:*:*:*:*
- medtronic guardian link 2 transmitter mmt-7731 firmwareall versionsnvdUScpe:2.3:o:medtronic:guardian_link_2_transmitter_mmt-7731_firmware:*:*:*:*:*:*:*:*
- medtronic guardian link 2 transmitter mmt-7738 firmwareall versionsnvdUScpe:2.3:o:medtronic:guardian_link_2_transmitter_mmt-7738_firmware:*:*:*:*:*:*:*:*
- medtronic guardian link 2 transmitter mmt-7775 firmwareall versionsnvdUScpe:2.3:o:medtronic:guardian_link_2_transmitter_mmt-7775_firmware:*:*:*:*:*:*:*:*
- medtronic guardian link 3 transmitter mmt-7810 firmwareall versionsnvdUScpe:2.3:o:medtronic:guardian_link_3_transmitter_mmt-7810_firmware:*:*:*:*:*:*:*:*
- medtronic guardian link 3 transmitter mmt-7811 firmwareall versionsnvdUScpe:2.3:o:medtronic:guardian_link_3_transmitter_mmt-7811_firmware:*:*:*:*:*:*:*:*
- medtronic minimed 620g mmt-1750 firmwareall versionsnvdUScpe:2.3:o:medtronic:minimed_620g_mmt-1750_firmware:*:*:*:*:*:*:*:*
- medtronic minimed 630g mmt-1715 firmwareall versionsnvdUScpe:2.3:o:medtronic:minimed_630g_mmt-1715_firmware:*:*:*:*:*:*:*:*
- medtronic minimed 630g mmt-1754 firmwareall versionsnvdUScpe:2.3:o:medtronic:minimed_630g_mmt-1754_firmware:*:*:*:*:*:*:*:*
- medtronic minimed 630g mmt-1755 firmwareall versionsnvdUScpe:2.3:o:medtronic:minimed_630g_mmt-1755_firmware:*:*:*:*:*:*:*:*
- medtronic minimed 640g mmt-1711 firmwareall versionsnvdUScpe:2.3:o:medtronic:minimed_640g_mmt-1711_firmware:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSMA-22-263-01Medtronic NGP 600 Series Insulin Pumps2022-09-20icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an unauthorized user to deliver too much or too little insulin through delivery of an unintended insulin bolus or because insulin delivery is slowed or stopped.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-32537/cnnvd
- https://global.medtronic.com/xg-en/product-security/security-bulletins/minimed-600-series-communication-issue.htmlcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsma-22-263-01cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.4665cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-263-01cnnvd
- https://www.medtronic.com/us-en/index.htmlPatchcnnvd
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-22-263-01enisa_euvd
- https://www.medtronic.com/en-us/e/product-security/security-bulletins/minimed-600-series-communication-issue.htmlenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan