CVE-2018-8868 Medtronic MyCareLink Patient Monitor Exposed Dangerous Method or Function
Attackers with physical proximity can exploit exposed debug code to read and write arbitrary memory on implantable cardiac devices via wireless protocols.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-8868?
CVE-2018-8868 is a medium-severity vulnerability in Medtronic 24950 MyCareLink Monitor, published on 2 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality.
Weakness: CWE-749
Which versions are affected by CVE-2018-8868?
It affects 2 products.
Products include Medtronic 24950 Mycarelink Monitor Firmware, Medtronic 24952 Mycarelink Monitor Firmware.
How do I fix CVE-2018-8868?
No fix has been published for CVE-2018-8868 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-8868 being exploited?
There is no known exploitation of CVE-2018-8868 in the wild and no public exploit code.
Other vulnerabilities in Medtronic 24950 MyCareLink Monitor
Sources
Also known as GHSA-c9h8-j583-w6wh.