What is the CVSS score of CVE-2019-10964?

CVE-2019-10964 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 1.2%.

Minimed 508 Firmware CVE-2019-10964

HIGH

Improper Access Control (CWE-284)

2019-06-28 ics-cert@hq.dhs.gov

7.1

CVSS 3.1 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

7.1 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 28, 2019 - 21:15 cve.org

HIGH 7.1

DescriptionCVE.org

Medtronic MiniMed Insulin Pumps

are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.

AnalysisAI

Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. Rated high severity (CVSS 7.1), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-284. Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery. Affected products include: Medtronic Minimed 508 Firmware, Medtronic Minimed Paradigm 511 Firmware, Medtronic Minimed Paradigm 512 Firmware, Medtronic Minimed Paradigm 712 Firmware, Medtronic Minimed Paradigm 712E Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.