What is the CVSS score of CVE-2018-8849?

CVE-2018-8849 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

N Vision 8840 Firmware CVE-2018-8849

MEDIUM

Missing Encryption of Sensitive Data (CWE-311)

2018-05-18 ics-cert@hq.dhs.gov

Information Disclosure N Vision 8840 Firmware N Vision 8870 Firmware

4.6

CVSS 3.1 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

May 18, 2018 - 13:29 cve.org

MEDIUM 4.6

DescriptionCVE.org

Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest.

AnalysisAI

Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-311. Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest. Affected products include: Medtronic N\'Vision 8840 Firmware, Medtronic N\'Vision 8870 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.