72 matches found
EUVD-2018-17218
Malware in sbrugna...
CVE-2025-4395
Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025...
Medtronic NGP 600 Series 安全漏洞
The Medtronic NGP 600 Series is a line of insulin pumps and accessories from Medtronic, Inc. A security vulnerability exists in Medtronic NGP 600 Series version 2.4, which originates from the exploitation of wireless signals that require proximity to the patient and the device. The following...
carelink.pa.gov Cross Site Scripting vulnerability OBB-2159513
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Medtronic Patches Implanted Device, CareLink Programmer Bugs
Medtronic has released updates to address known vulnerabilities in its line of connected medical devices that were initially disclosed last year and in 2018. The vendor has addressed two sets of bugs. The first group, disclosed in March of last year, is found in a range of Medtronic implanted...
CVE-2018-18984
Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest...
Information disclosure
Medtronic CareLink 2090 Programmer CareLink 9790 Programmer 29901 Encore Programmer, all versions, The affected products do not encrypt or do not sufficiently encrypt the following sensitive information while at rest PII and PHI...
CVE-2018-18984 Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data
Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest...
CVE-2018-18984
CVE-2018-18984 affects Medtronic CareLink and Encore Programmers (9790, 2090, 29901 Encore). The vulnerability is caused by missing or insufficient encryption of sensitive data (PII/PHI) at rest. Impact, as described, is potential exposure of PHI/PII to someone with physical access to the device....
Remote Code Implantation Flaw Found in Medtronic Cardiac Programmers
A flaw in Medtronic’s CareLink 2090 and CareLink Encore 29901 programmers, which are portable computer systems used to manage implanted cardiac devices in clinical settings, would have allowed remote code implantation over Medtronic’s dedicated Software Deployment Network SDN. The programmers are...
October 16, 2018 – Morning Cyber Coffee Headlines – “Yale” Edition
Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 16, 2018 - Headlines U.K. Cyber Security Center Says Most Attacks Are...
The vulnerability of Medtronic MyCareLink Patient Monitor lies in the insufficient verification of data authenticity, allowing attackers to inject arbitrary information into the Medtronic CareLink network.
The vulnerability of Medtronic MyCareLink Patient Monitor relates to insufficient verification of data authenticity. Exploiting this vulnerability could allow an attacker, operating remotely, to inject arbitrary information into the Medtronic CareLink network...
Design/Logic Flaw
A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient Monitor. The affected product's update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable...
CVE-2018-10622
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication...
CVE-2018-10626 Medtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLin...
Medtronic 2090 CareLink Programmer Design Vulnerability
The Medtronic 2090 CareLink Programmer is a suite of portable computer products from Medtronic, Inc. The product is used to manage and program cardiac devices in the medical industry. A security vulnerability exists in all versions of the Medtronic 2090 CareLink Programmer in the affected product...
CVE-2018-10596
Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this virtual private network before downloading updates. The affected products initially establish an encapsulated IP-based VPN connection to a...
CVE-2018-8868
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit oth...
Code injection
Medtronic 2090 CareLink Programmer all versions The affected product uses a virtual private network connection to securely download updates. The product does not verify it is still connected to this virtual private network before downloading updates. An attacker with local network access to the...
CVE-2018-10596 Medtronic 2090 Carelink Programmer Improper Restriction of Communication Channel to Intended Endpoints
Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this virtual private network before downloading updates. The affected products initially establish an encapsulated IP-based VPN connection to a...