CVE-2018-8868
Severity CVSS v4.0:
Pending analysis
Type:
CWE-749
Exposed Dangerous Method or Function
Publication date:
03/07/2018
Last modified:
22/05/2025
Description
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality.
Impact
Base Score 3.x
6.20
Severity 3.x
MEDIUM
Base Score 2.0
6.90
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:medtronic:24950_mycarelink_monitor_firmware:-:*:*:*:*:*:*:* | ||
| cpe:2.3:h:medtronic:24950_mycarelink_monitor:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:medtronic:24952_mycarelink_monitor_firmware:-:*:*:*:*:*:*:* | ||
| cpe:2.3:h:medtronic:24952_mycarelink_monitor:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page