CVE-2018-8870

2018-06-2900:00:00

CWE-259

icscert

www.cve.org

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.7%

JSON

Medtronic MyCareLink Patient Monitor, 24950 MyCareLink Monitor, all versions, and 24952 MyCareLink Monitor, all versions contains a hard-coded operating system password. An attacker with physical access can remove the case of the device, connect to the debug port, and use the password to gain privileged access to the operating system.

CNA Affected

[
  {
    "product": "Medtronic MyCareLink Patient Monitor",
    "vendor": "ICS-CERT",
    "versions": [
      {
        "status": "affected",
        "version": "24950 MyCareLink Monitor, all versions, 24952 MyCareLink Monitor, all versions."
      }
    ]
  }
]

References

ics-cert.us-cert.gov/advisories/ICSMA-18-179-01