High severity · published Dec 14, 2020
CVE-2020-25183
Medtronic MyCareLink Smart 25000 contains an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader and the Medtronic…
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
Medtronic MyCareLink Smart 25000 contains
an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader and the Medtronic MyCareLink Smart mobile app is vulnerable to bypass. This vulnerability enables an attacker to use another mobile device or malicious application on the patient’s smartphone to authenticate to the patient’s Medtronic Smart Reader, fooling the device into believing it is communicating with the original Medtronic smart phone application when executed within range of Bluetooth communication.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Mycarelink Smart Model 25000 Firmware · Medtronic
All versions, or not specified · source: NVD
Affected product
MS
Mycarelink Smart Model 25000 Firmware
Medtronic
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25183
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25183
global.medtronic.com
https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-smart-security-vulnerability-patch.html
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-345-01
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01
More from Mycarelink Smart Model 25000 Firmware
9.8
CVE-2020-25187
Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event…
8.1
CVE-2020-27252
Medtronic MyCareLink Smart 25000 is vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and…