Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Abbott pacemakers before Aug 2017 can be remotely commanded

CVE-2017-12712 · published 8 years ago
Summary

Abbott pacemakers made before August 28, 2017 use a weak authentication method that could be bypassed by someone nearby using radio signals. An attacker could send unauthorized commands to the device, potentially affecting its operation. Abbott has released firmware updates for the affected models to fix the problem, so applying the updates as soon as possible is recommended.

What to do
  • Update abbott accent_firmware to version f0b.0e.7e or later.
  • Update abbott anthem_firmware to version f0b.0e.7e or later.
  • Update abbott accent_mri_firmware to version f10.08.6c or later.
  • Update abbott accent_st_firmware to version f10.08.6c or later.
  • Update abbott assurity_firmware to version f14.07.80 or later.
  • Update abbott allure_firmware to version f14.07.80 or later.
  • Update abbott assurity_mri_firmware to version f17.01.49 or later.
Affected software
VendorProductAffected versions
abbott accent_firmware < f0b.0e.7e
cpe:2.3:o:abbott:accent_firmware:*:*:*:*:*:*:*:*
abbott anthem_firmware < f0b.0e.7e
cpe:2.3:o:abbott:anthem_firmware:*:*:*:*:*:*:*:*
abbott accent_mri_firmware < f10.08.6c
cpe:2.3:o:abbott:accent_mri_firmware:*:*:*:*:*:*:*:*
abbott accent_st_firmware < f10.08.6c
cpe:2.3:o:abbott:accent_st_firmware:*:*:*:*:*:*:*:*
abbott assurity_firmware < f14.07.80
cpe:2.3:o:abbott:assurity_firmware:*:*:*:*:*:*:*:*
abbott allure_firmware < f14.07.80
cpe:2.3:o:abbott:allure_firmware:*:*:*:*:*:*:*:*
abbott assurity_mri_firmware < f17.01.49
cpe:2.3:o:abbott:assurity_mri_firmware:*:*:*:*:*:*:*:*
Original advisory text
The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may all...
The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3 base score: 7.5, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published25 Apr 2018
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-12712 · NVD
Track software like this
Free during beta