CVE-2019-10964
Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
Timeline
- CVE published
- Record last updated
Affected versions
- Medtronic MiniMed 508 pump
All versions
- Medtronic MiniMed Paradigm 511 pump
All versions
- Medtronic MiniMed Paradigm 512/712 pumps
All versions
- Medtronic MiniMed Paradigm 712E pump
All versions
- Medtronic MiniMed Paradigm 515/715 pumps
All versions
- Medtronic MiniMed Paradigm 522/722 pumps
All versions
- Medtronic MiniMed Paradigm 522K/722K pumps
All versions
- Medtronic MiniMed Paradigm 523/723 pumps
through Software Versions 2.4A
- Medtronic MiniMed Paradigm 523K/723K pumps
through Software Versions 2.4A
- Medtronic MiniMed Paradigm Veo 554/754 pumps
through Software Versions 2.6A
- Medtronic MiniMed Paradigm Veo 554CM/754CM pumps
through Software Versions 2.7A