Critical severity · published Dec 14, 2020
CVE-2020-25187
Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event…
9.8
CVSS
3.9%
EPSS
No
On KEV
Description
Medtronic MyCareLink Smart 25000 is
vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event within the MCL Smart Patient Reader software stack. The heap overflow could allow an attacker to remotely execute code on the MCL Smart Patient Reader, potentially leading to control of the device
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Mycarelink Smart Model 25000 Firmware · Medtronic
All versions, or not specified · source: NVD
Affected product
MS
Mycarelink Smart Model 25000 Firmware
Medtronic
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25187
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25187
global.medtronic.com
https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-smart-security-vulnerability-patch.html
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-345-01
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01
More from Mycarelink Smart Model 25000 Firmware
8.8
CVE-2020-25183
Medtronic MyCareLink Smart 25000 contains an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader and the Medtronic…
8.1
CVE-2020-27252
Medtronic MyCareLink Smart 25000 is vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and…
