PT-2016-6237

Name of the Vulnerable Software and Affected Versions Johnson & Johnson Animas OneTouch Ping devices affected versions not specified Description The issue allows remote attackers to bypass authentication via replay attacks. Recommendations At the moment, there is no information about a newer...

PT-2016-6640

Name of the Vulnerable Software and Affected Versions Johnson & Johnson Animas OneTouch Ping devices affected versions not specified Description The issue concerns the mishandling of acknowledgements in the custom communication protocol used by the devices, making it easier for remote attackers t...

PT-2016-6236

Name of the Vulnerable Software and Affected Versions Johnson & Johnson Animas OneTouch Ping devices affected versions not specified Description The issue concerns the generation of random numbers in the devices, making it easier for remote attackers to spoof meters. This can be achieved by...

CVE-2016-5686: Improper Authentication

Johnson & Johnson Animas OneTouch Ping devices mishandle acknowledgements, which makes it easier for remote attackers to bypass authentication via a custom communication protocol...

CVE-2016-5085: Use of Insufficiently Random Values

Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof meters by sniffing the network and then engaging in an authentication handshake...

CVE-2016-5086: Improper Authentication

Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks...

CVE-2016-5084: Undefined Security Weakness

Johnson & Johnson Animas OneTouch Ping devices do not use encryption for certain data, which might allow remote attackers to obtain sensitive information by sniffing the network...

Animas OneTouch Ping insulin pump contains multiple vulnerabilities

Overview The Animas OneTouch Ping insulin pump contains multiple vulnerabilities that may allow an unauthenticated remote attacker to obtain patient treatment or device data, or execute commands on the device. The attacker cannot obtain personally identifiable information. Description CWE-319:...