Medium severity · published Jul 3, 2018
CVE-2018-8868
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the…
6.2
CVSS
0.3%
EPSS
No
On KEV
Description
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality.
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Attack vector
Physical
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2M
24950 Mycarelink Monitor Firmware · Medtronic
All versions, or not specified · source: NVD
2M
24952 Mycarelink Monitor Firmware · Medtronic
All versions, or not specified · source: NVD