CVE-2017-12716 Information disclosure in Accent and Anthem
Attackers can read unencrypted patient data transmitted via RF or stored on Abbott Accent and Anthem pacemakers, requiring a firmware update to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12716?
CVE-2017-12716 is a medium-severity vulnerability in Abbott Laboratories Accent and Anthem, published on 25 Apr 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programmers and home monitoring units. Additionally, the Accent and Anthem pacemakers store the optional patient information without encryption. CVSS v3 base score: 3.1, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
Which versions are affected by CVE-2017-12716?
It affects 4 products.
Products include Abbott Accent Firmware, Abbott Accent Mri Firmware, Abbott Accent St Firmware, Abbott Anthem Firmware.
How do I fix CVE-2017-12716?
No fix has been published for CVE-2017-12716 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-12716 being exploited?
There is no known exploitation of CVE-2017-12716 in the wild and no public exploit code.
Other vulnerabilities in Abbott Laboratories Accent and Anthem
Sources
Also known as GHSA-x247-46rv-347w.