Medtronic MiniMed Insulin Pump CVE-2019-10965 Improper Access Control Vulnerability

Critical Vulnerability Information 1. Vulnerability Overview CVSS v3.1: 7.1 Vendor: Medtronic Affected Devices: MiniMed 508 and Paradigm Series Insulin Pumps Vulnerability Type: Improper Access Control 2. Risk Assessment Successful exploitation of this vulnerability may allow an attacker to interact with, modify, or interfere with affected products via wireless radio frequency (RF) communication, potentially enabling the reading of sensitive data, altering pump settings, or controlling insulin delivery. 3. Technical Details 3.1 Affected Products MiniMed 508 Pump - All versions MiniMed Paradigm 511 Pump - All versions MiniMed Paradigm 712/722 Pumps - All versions MiniMed Paradigm 712E Pump - All versions MiniMed Paradigm 515/715 Pumps - All versions MiniMed Paradigm 522/722 Pumps - All versions MiniMed Paradigm 522K/722K Pumps - All versions MiniMed Paradigm 523/723 Pumps - Software version 2.4A or lower MiniMed Paradigm 523K/723K Pumps - Software version 2.4A or lower MiniMed Paradigm Veo 554/754 Pumps - Software version 2.6A or lower MiniMed Paradigm Veo 554CM and 754CM Models - Software version 2.7A or lower 3.2 Vulnerability Description Improper Access Control CWE-284 - The affected insulin pumps are designed to communicate wirelessly via RF with other devices (such as glucose meters, glucose sensors, and CareLink USB devices). The wireless RF communication protocol lacks proper authentication or authorization mechanisms, allowing an adjacent attacker to inject, modify, or intercept data. - CVE-2019-10965 has been assigned to this vulnerability, with a CVSS v3 base score of 7.1. 4. Mitigation Measures Medtronic recommends that patients in the United States contact their healthcare provider to replace their insulin pump with a newer model featuring enhanced cybersecurity protections. Recommended cybersecurity precautions for all patients: - Maintain physical control over the pump and its connected devices. - Do not share the pump’s serial number. - Pay attention to pump notifications, alerts, and alarms. - Immediately cancel any unexpected bolus deliveries. - Avoid connecting to any third-party devices or unauthorized software. - Disconnect CareLink USB devices when not in use. - Closely monitor blood glucose levels and take appropriate action. - Seek immediate medical help if experiencing symptoms of severe hyperglycemia or diabetic ketoacidosis. NCSCIC advises users to implement defensive measures to minimize the risk of exploitation, particularly by restricting system access and device connections to authorized personnel, and adhering to the principle of least privilege.

Goal Reached Thanks to every supporter — we hit 100%!

Medtronic MiniMed Insulin Pump CVE-2019-10965 Improper Access Control Vulnerability