Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control

Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

访问控制不恰当

多款Medtronic产品访问控制错误漏洞

Medtronic MiniMed 508 pump等都是美国美敦力（Medtronic）公司的一款胰岛素泵。 多款Medtronic产品中存在访问控制错误漏洞。该漏洞源于网络系统或产品未正确限制来自未授权角色的资源访问。以下产品及版本受到影响：MiniMed 508 pump（全部版本）；MiniMed Paradigm 511 pump（全部版本）；MiniMed Paradigm 512/712 pumps（全部版本）；MiniMed Paradigm 712E pump（全部版本）；MiniMed

N/A

N/A