Lucene search

IcscertCVE-2018-10596

HistoryJul 03, 2018 - 1:29 a.m.

CVE-2018-10596

2018-07-0301:29:00

CWE-923

CWE-200

icscert

web.nvd.nist.gov

medtronic

2090 carelink

programmer

vpn

connection

security

update

local network

attack

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

0.4%

JSON

Medtronic 2090 CareLink Programmer all versions The affected product uses a virtual private network connection to securely download updates. The product does not verify it is still connected to this virtual private network before downloading updates. An attacker with local network access to the programmer could influence these communications.

Affected configurations

Nvd

Node

medtronic2090_carelink_programmer_firmware

AND

medtronic2090_carelink_programmerMatch-

VendorProductVersionCPE
medtronic2090_carelink_programmer_firmware*cpe:2.3:o:medtronic:2090_carelink_programmer_firmware:*:*:*:*:*:*:*:*
medtronic2090_carelink_programmer-cpe:2.3:h:medtronic:2090_carelink_programmer:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
medtronic	2090_carelink_programmer_firmware	*	cpe:2.3:o:medtronic:2090_carelink_programmer_firmware::::::::
medtronic	2090_carelink_programmer	-	cpe:2.3:h:medtronic:2090_carelink_programmer:-:::::::*

CNA Affected

[
  {
    "product": "Medtronic 2090 CareLink Programmer",
    "vendor": "ICS-CERT",
    "versions": [
      {
        "status": "affected",
        "version": "2090 CareLink Programmer, all versions."
      }
    ]
  }
]

References

ics-cert.us-cert.gov/advisories/ICSMA-18-058-01

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

0.4%

JSON

Related for CVE-2018-10596