6.4med
CVE-2018-8870
Medtronic MyCareLink Patient Monitor Use of Hard-coded Password
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.4
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 30%
Public exploits
0
none known
Summary
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove the case of the device, connect to the debug port, and use the password to gain privileged access to the operating system.
Exploit prediction (EPSS)
0.36% probability of exploitation in the next 30 days, higher than 30% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 6.4 | CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 6.4 | CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.0 | 6.8 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Medtronic 24950 MyCareLink Monitor
- Medtronic 24952 MyCareLink Monitor
Classification
References
- global.medtronic.com /xg-en/product-security/security-bulletins/mycarelink-6-28-18.html
- ics-cert.us-cert.gov /advisories/ICSMA-18-179-01 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-8870
- NVD: CVE-2018-8870
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.