Vulnerability in Medtronic 24950 Mycarelink Monitor
CVE-2018-8868
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L.
EPSS exploit prediction
EPSS: 0.003 (24.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 24.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
Weakness classification (CWE)
References
- global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-6-28-…
- ics-cert.us-cert.gov/advisories/ICSMA-18-179-01 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-8868?
- CVE-2018-8868 is a medium-severity vulnerability in Medtronic 24950 Mycarelink Monitor, classified under CWE-749. CVSS score: 6.2/10. Published 2018-07-03.
- How severe is CVE-2018-8868?
- Medium severity. CVSS v3 base score is 6.2 out of 10.