Vulnerability in Medtronic CareLink Programmer Allows Unauthorized Update Manipulation

CVE-2018-10596

What is CVE-2018-10596?

The Medtronic 2090 CareLink Programmer is susceptible to a communication manipulation vulnerability. This issue arises because the device establishes a virtual private network (VPN) connection to securely download updates, but it fails to verify its ongoing connection to this VPN before initiating the download process. If an attacker gains local network access to the programmer, they may exploit this flaw to influence the update communications, potentially leading to unauthorized updates.

References