508 Minimed Insulin Pump Firmware
CVE-2018-14781
MEDIUM
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (hq) · only source for this CVE.
CVSS VectorVendor: hq
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
Medtronic MiniMed MMT
devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.
AnalysisAI
Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-294. Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery. Affected products include: Medtronicdiabetes 508 Minimed Insulin Pump Firmware, Medtronicdiabetes 522 Paradigm Real-Time Firmware, Medtronicdiabetes 722 Paradigm Real-Time Firmware, Medtronicdiabetes 523 Paradigm Revel Firmware, Medtronicdiabetes 723 Paradigm Revel Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today