Authentication Bypass Vulnerability in Medtronic MyCareLink Smart Product
CVE-2020-25183

8HIGH

Key Information:

Vendor

Medtronic

Status
Smart Model 25000 Patient Reader
Vendor
CVE Published:
14 December 2020

What is CVE-2020-25183?

The Medtronic MyCareLink Smart 25000 all versions are impacted by an authentication protocol vulnerability that allows attackers to bypass authentication measures. This issue arises during the communication between the MCL Smart Patient Reader and the MyCareLink Smart mobile app. An attacker could exploit this weakness to authenticate to the patient’s Smart Reader using a different mobile device or a malicious application. The vulnerability occurs when the attacker's device tricks the Smart Reader into thinking it is communicating with the legitimate and authorized mobile application via Bluetooth, potentially compromising patient data and device functionality.

Affected Version(s)

Smart Model 25000 Patient Reader All versions

References

https://global.medtronic.com/xg-en/product-security/secur...
x_refsource_MISC
https://www.cisa.gov/news-events/ics-medical-advisories/i...

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.