Medtronic MiniMed 600 Series Insulin Pumps CVE-2022-32537 Vulnerability Analysis

Medtronic NGP 600 Series Insulin Pumps Vulnerability Summary Vulnerability Overview Vulnerability Name: Protection Mechanism Failure CVE ID: CVE-2022-32537 CVSS Score: 4.8 (CVSS v3.4.8) Vulnerability Description: A vulnerability exists that allows unauthorized users to learn the communication protocol used for pairing system components when the pump is paired with other system components. Exploiting this vulnerability requires the attacker to maintain a close-range wireless signal connection with the patient and the device, and requires advanced technical knowledge. Potential Impact: Successful exploitation of this vulnerability could result in unauthorized users delivering too much or too little insulin to the patient via accidental insulin boluses or slowed/stopped insulin delivery. Scope of Impact Affected Products: Medtronic MiniMed 600 Series Insulin Pumps Specific Models and Firmware Versions: MiniMed 620G: MMT-1710 MiniMed 630G: MMT-1715, MMT-1754, MMT-1755 MiniMed 640G: MMT-1711, MMT-1712, MMT-1751, MMT-1752 MiniMed 670G: MMT-1740, MMT-1741, MMT-1742, MMT-1760, MMT-1762, MMT-1762, MMT-1780, MMT-1781, MMT-1782 Deployment Regions: Worldwide Industry Sector: Healthcare and Public Health Remediation Medtronic recommends that users take the following measures: 1. Disable the "Remote Bolus" feature: Turn off the "Remote Bolus" feature on the pump. Note: Disabling this feature ensures that remote boluses cannot be performed. 2. Restrict connection environments: Connect or pair devices only in private settings. Additional Preventive Measures: Ensure that the pump and connected system components are always controlled by authorized users. Pay attention to pump alarms and notifications. Immediately cancel any bolus not initiated by authorized personnel; closely monitor blood glucose levels and report to Medtronic 24-hour Technical Support. Disconnect USB devices from the computer when downloading pump data. Do not confirm remote connection requests or any other remote operations on the pump screen unless initiated by authorized care providers. Avoid sharing the pump or device serial number with individuals other than healthcare providers, distributors, and Medtronic. Do not accept, calibrate, or use blood glucose readings for boluses that were not initiated by authorized care providers. Do not connect or allow any third-party devices to connect to the pump. Do not use software that has not been authorized by Medtronic as safe for the pump. If the patient exhibits symptoms of severe hypoglycemia or diabetic ketoacidosis, seek medical attention immediately. If improper changes to pump settings or insulin delivery are suspected due to a lack of appropriate knowledge, encourage users to contact Medtronic 24-hour Technical Support at 1-800-646-4633. No Known Public Exploit Code (POC)**

Goal Reached Thanks to every supporter — we hit 100%!

Medtronic MiniMed 600 Series Insulin Pumps CVE-2022-32537 Vulnerability Analysis