Lucene search

IcscertCVE-2018-5446

HistoryMay 04, 2018 - 6:29 p.m.

CVE-2018-5446

2018-05-0418:29:00

CWE-522

CWE-257

icscert

web.nvd.nist.gov

medtronic

2090 carelink programmer

cve-2018-5446

security vulnerability

username

password

recoverable format

physical access

attacker

software deployment network

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

38.7%

JSON

All versions of the Medtronic 2090 Carelink Programmer are affected by a per-product username and password that is stored in a recoverable format which could allow an attacker with physical access to a 2090 Programmer to obtain per-product credentials to the software deployment network.

Affected configurations

Nvd

Node

medtronic2090_carelink_programmer_firmware

AND

medtronic2090_carelink_programmerMatch-

VendorProductVersionCPE
medtronic2090_carelink_programmer_firmware*cpe:2.3:o:medtronic:2090_carelink_programmer_firmware:*:*:*:*:*:*:*:*
medtronic2090_carelink_programmer-cpe:2.3:h:medtronic:2090_carelink_programmer:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
medtronic	2090_carelink_programmer_firmware	*	cpe:2.3:o:medtronic:2090_carelink_programmer_firmware::::::::
medtronic	2090_carelink_programmer	-	cpe:2.3:h:medtronic:2090_carelink_programmer:-:::::::*

CNA Affected

[
  {
    "product": "Medtronic 2090 CareLink Programmer",
    "vendor": "ICS-CERT",
    "versions": [
      {
        "status": "affected",
        "version": "All versions are affected"
      }
    ]
  }
]

References

ics-cert.us-cert.gov/advisories/ICSMA-18-058-01

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

38.7%

JSON

Related for CVE-2018-5446