CVE-2023-25931 Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue
Attackers with physical access can bypass password controls to gain unauthorized control over clinician therapy parameters in Medtronic apps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-25931?
CVE-2023-25931 is a medium-severity authentication bypass vulnerability in Medtronic InsterStim Applications, published on 1 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which has greater control over therapy parameters than the patient app. Changes still cannot be made outside of the established therapy parameters of the programmer. For unauthorized access to occur, an individual would need physical access to the Smart Programmer.
Which versions are affected by CVE-2023-25931?
It affects 2 products.
Products include Medtronic Interstim X Clinician, Medtronic Micro Clinician.
How do I fix CVE-2023-25931?
No fix has been published for CVE-2023-25931 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-25931 being exploited?
There is no known exploitation of CVE-2023-25931 in the wild and no public exploit code.
Sources
Also known as GHSA-crgr-72p3-3g72.