CVE-2019-10964
Description
Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| medtronic minimed_508_firmware | No range specified | — |
| medtronic minimed_paradigm_511_firmware | No range specified | — |
| medtronic minimed_paradigm_512_firmware | No range specified | — |
| medtronic minimed_paradigm_712_firmware | No range specified | — |
| medtronic minimed_paradigm_712e_firmware | No range specified | — |
| medtronic minimed_paradigm_515_firmware | No range specified | — |
| medtronic minimed_paradigm_715_firmware | No range specified | — |
| medtronic minimed_paradigm_522_firmware | No range specified | — |
| medtronic minimed_paradigm_722_firmware | No range specified | — |
| medtronic minimed_paradigm_522k_firmware | No range specified | — |
| medtronic minimed_paradigm_722k_firmware | No range specified | — |
| medtronic minimed_paradigm_523_firmware | v ≤ 2.4a | — |
| medtronic minimed_paradigm_723_firmware | v ≤ 2.4a | — |
| medtronic minimed_paradigm_523k_firmware | v ≤ 2.4a | — |
| medtronic minimed_paradigm_723k_firmware | v ≤ 2.4a | — |
| medtronic minimed_paradigm_veo_554_firmware | v ≤ 2.6a | — |
| medtronic minimed_paradigm_veo_754_firmware | v ≤ 2.6a | — |
| medtronic minimed_paradigm_veo_554cm_firmware | v ≤ 2.7a | — |
| medtronic minimed_paradigm_veo_754cm_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.