Medium severity · published Jul 13, 2018
CVE-2018-10631
The 8840 Clinician Programmer executes the application program from the 8870 Application Card
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 Application Card and sufficient technical capability can modify the contents of this card, including the binary executables. If modified to bypass protection mechanisms, this malicious code will be run when the card is inserted into an 8840 Clinician Programmer.
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
N8
N'vision 8840 Firmware · Medtronic
All versions, or not specified · source: NVD
N8
N'vision 8870 Firmware · Medtronic
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-10631
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-10631
www.securityfocus.com
http://www.securityfocus.com/bid/104213
global.medtronic.com
https://global.medtronic.com/xg-en/product-security/security-bulletins/nvision.html
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01
Vendor Advisory
https://www.medtronic.com/security
More from N'vision 8840 Firmware
4.6
CVE-2018-8849
Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest