What is the CVSS score of CVE-2018-8868?

CVE-2018-8868 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.3%.

24950 Mycarelink Monitor Firmware CVE-2018-8868

MEDIUM

Exposed Dangerous Method or Function (CWE-749)

2018-07-03 ics-cert@hq.dhs.gov

RCE 24950 Mycarelink Monitor Firmware 24952 Mycarelink Monitor Firmware

6.2

CVSS 3.1 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

6.2 MEDIUM

AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Attack Vector

Physical

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Jul 03, 2018 - 01:29 cve.org

MEDIUM 6.2

DescriptionCVE.org

Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-749. Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality. Affected products include: Medtronic 24950 Mycarelink Monitor Firmware, Medtronic 24952 Mycarelink Monitor Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.