Vulnerability Description
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove the case of the device, connect to the debug port, and use the password to gain privileged access to the operating system.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Medtronic | 24950 Mycarelink Monitor Firmware | - |
| Medtronic | 24950 Mycarelink Monitor | - |
| Medtronic | 24952 Mycarelink Monitor Firmware | - |
| Medtronic | 24952 Mycarelink Monitor | - |
Related Weaknesses (CWE)
References
- https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelin
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01Third Party AdvisoryUS Government Resource
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2018-8870?
CVE-2018-8870 is a vulnerability with a CVSS score of 6.4 (MEDIUM). Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove the case of the device, connect to the debu...
How severe is CVE-2018-8870?
CVE-2018-8870 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-8870?
Check the references section above for vendor advisories and patch information. Affected products include: Medtronic 24950 Mycarelink Monitor Firmware, Medtronic 24950 Mycarelink Monitor, Medtronic 24952 Mycarelink Monitor Firmware, Medtronic 24952 Mycarelink Monitor.