Medium severity · published Jul 3, 2018
CVE-2018-8870
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password
6.4
CVSS
0.4%
EPSS
No
On KEV
Description
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove the case of the device, connect to the debug port, and use the password to gain privileged access to the operating system.
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2M
24950 Mycarelink Monitor Firmware · Medtronic
All versions, or not specified · source: NVD
2M
24952 Mycarelink Monitor Firmware · Medtronic
All versions, or not specified · source: NVD
Affected product
2M
24950 Mycarelink Monitor Firmware
Medtronic
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8870
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8870
global.medtronic.com
https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-6-28-18.html
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01
More from 24950 Mycarelink Monitor Firmware
6.2
CVE-2018-8868
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the…