CVE-2017-12714 Denial of service in Accent/Anthem, Accent MRI, Assurity/Allure, and Assurity MRI.
A nearby attacker can drain the battery of Abbott pacemakers by repeatedly sending RF wake-up commands, potentially causing device failure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12714?
CVE-2017-12714 is a medium-severity denial of service vulnerability in Abbott Laboratories Accent/Anthem, Accent MRI, Assurity/Allure, and Assurity MRI., published on 25 Apr 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017 do not restrict or limit the number of correctly formatted "RF wake-up" commands that can be received, which may allow a nearby attacker to repeatedly send commands to reduce pacemaker battery life. CVSS v3 base score: 5.3, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
Weakness: CWE-920
Which versions are affected by CVE-2017-12714?
It affects 7 products.
Products include Abbott Accent Firmware, Abbott Accent Mri Firmware, Abbott Accent St Firmware, Abbott Allure Firmware, Abbott Anthem Firmware, Abbott Assurity Firmware and 1 more.
How do I fix CVE-2017-12714?
No fix has been published for CVE-2017-12714 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-12714 being exploited?
There is no known exploitation of CVE-2017-12714 in the wild and no public exploit code.
Other vulnerabilities in Abbott Laboratories Accent/Anthem, Accent MRI, Assurity/Allure, and Assurity MRI.
Sources
Also known as GHSA-4gwc-877g-8pxq.