Mycarelink 24950 Patient Monitor Firmware CVEs and Security Vulnerabilities

CVE-2018-10622

Medtronic MyCareLink Patient Monitor Network Credential Weakness

Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Medtronic

Products

Mycarelink 24950 Patient Monitor Mycarelink 24950 Patient Monitor Firmware Mycarelink 24952 Patient Monitor and 1 more

CVE-2018-10626

Medtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity

Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLink network.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed