CVE-2017-12712 Auth bypass in Accent/Anthem, Accent MRI, Assurity/Allure, and Assurity MRI.
A nearby attacker can bypass authentication to issue unauthorized commands to Abbott pacemakers via RF communications, potentially compromising device integrity and safety.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12712?
CVE-2017-12712 is a high-severity authentication bypass vulnerability in Abbott Laboratories Accent/Anthem, Accent MRI, Assurity/Allure, and Assurity MRI., published on 25 Apr 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3 base score: 7.5, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
Weakness: CWE-287
Which versions are affected by CVE-2017-12712?
It affects 7 products.
Products include Abbott Accent Firmware, Abbott Accent Mri Firmware, Abbott Accent St Firmware, Abbott Allure Firmware, Abbott Anthem Firmware, Abbott Assurity Firmware and 1 more.
How do I fix CVE-2017-12712?
No fix has been published for CVE-2017-12712 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-12712 being exploited?
There is no known exploitation of CVE-2017-12712 in the wild and no public exploit code.
Other vulnerabilities in Abbott Laboratories Accent/Anthem, Accent MRI, Assurity/Allure, and Assurity MRI.
Sources
Also known as GHSA-fgxh-jxxp-vj3c.