Vulnerability Description
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications use deterministic keys, which allows unauthenticated, physically proximate attackers to brute-force the keys via Bluetooth Low Energy.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sooil | Anydana-A Firmware | < 3.0 |
| Sooil | Anydana-A | - |
| Sooil | Anydana-I Firmware | < 3.0 |
| Sooil | Anydana-I | - |
| Sooil | Diabecare Rs Firmware | < 3.0 |
| Sooil | Diabecare Rs | - |
Related Weaknesses (CWE)
References
- https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01Third Party AdvisoryUS Government Resource
- https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2020-27264?
CVE-2020-27264 is a vulnerability with a CVSS score of 8.8 (HIGH). In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications use deterministic keys, which a...
How severe is CVE-2020-27264?
CVE-2020-27264 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-27264?
Check the references section above for vendor advisories and patch information. Affected products include: Sooil Anydana-A Firmware, Sooil Anydana-A, Sooil Anydana-I Firmware, Sooil Anydana-I, Sooil Diabecare Rs Firmware.