CVE-2017-12712
High
Description
The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3 base score: 7.5, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
SeverityHigh
CVSS8.8
Exploit probability—
ProductAbbott Accent Firmware
PublishedApr 25, 2018
First seenApr 25, 2018
Weakness typeCWE-287Improper authentication
How to fix
Update
- abbott accent_firmwaref0b.0e.7e or later
- abbott anthem_firmwaref0b.0e.7e or later
- abbott accent_mri_firmwaref10.08.6c or later
- abbott accent_st_firmwaref10.08.6c or later
- abbott assurity_firmwaref14.07.80 or later
- abbott allure_firmwaref14.07.80 or later
- abbott assurity_mri_firmwaref17.01.49 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| abbott accent_firmware | v < f0b.0e.7e | f0b.0e.7e |
| abbott anthem_firmware | v < f0b.0e.7e | f0b.0e.7e |
| abbott accent_mri_firmware | v < f10.08.6c | f10.08.6c |
| abbott accent_st_firmware | v < f10.08.6c | f10.08.6c |
| abbott assurity_firmware | v < f14.07.80 | f14.07.80 |
| abbott allure_firmware | v < f14.07.80 | f14.07.80 |
| abbott assurity_mri_firmware | v < f17.01.49 | f17.01.49 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.