CVE-2018-10626

Опубликовано: 10 авг. 2018

Источник: nvd

CVSS3: 4.4

CVSS2: 3.8

EPSS Низкий

Описание

Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLink network.

Ссылки

http://www.securityfocus.com/bid/105042
Third Party Advisory
VDB Entry
https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html
https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/105042
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:medtronic:mycarelink_24952_patient_monitor_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:medtronic:mycarelink_24952_patient_monitor:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:medtronic:mycarelink_24950_patient_monitor_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:medtronic:mycarelink_24950_patient_monitor:-:*:*:*:*:*:*:*

EPSS

Процентиль: 10%

0.00036

Низкий

4.4 Medium

CVSS3

4.4 Medium

CVSS3

3.8 Low

CVSS2

Дефекты

CWE-345

Связанные уязвимости

GHSA-gf7p-63p6-4m97

CVSS3: 4.4

github

больше 3 лет назад

A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient Monitor. The affected product's update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLink network.

BDU:2018-00980

CVSS3: 4.4

fstec

больше 7 лет назад

Уязвимость медицинского оборудования Medtronic MyCareLink Patient Monitor, связанная с недостаточной проверкой подлинности данных, позволяющая нарушителю загружать произвольную информацию в сеть Medtronic CareLink

EPSS

Процентиль: 10%

0.00036

Низкий

4.4 Medium

CVSS3

4.4 Medium

CVSS3

3.8 Low

CVSS2

Дефекты

CWE-345