Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.4
CVE-2018-10626: Medtronic MyCareLink monitors can accept forged data
CVE-2018-10626 · published 8 years ago
Summary
The MyCareLink patient monitors may accept data that hasn’t been properly checked for authenticity. If someone obtains the device’s login details, they could upload false information to the CareLink network, potentially affecting treatment records. Apply the latest firmware updates from Medtronic and change default credentials as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| medtronic | mycarelink_24952_patient_monitor_firmware |
All versions
cpe:2.3:o:medtronic:mycarelink_24952_patient_monitor_firmware:-:*:*:*:*:*:*:* |
| medtronic | mycarelink_24950_patient_monitor_firmware |
All versions
cpe:2.3:o:medtronic:mycarelink_24950_patient_monitor_firmware:-:*:*:*:*:*:*:* |
Original advisory text
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An
attacker who obtains per-product credentials from the monitor and paire...
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An
attacker who obtains per-product credentials from the monitor and paired
implantable cardiac device information can potentially upload invalid
data to the Medtronic CareLink network.
attacker who obtains per-product credentials from the monitor and paired
implantable cardiac device information can potentially upload invalid
data to the Medtronic CareLink network.
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2018/icsma-18-2...
- https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelin...
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-219-01
- http://www.securityfocus.com/bid/105042 Third Party Advisory VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 Third Party Advisory US Government Resource
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published10 Aug 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-10626 · NVD
Track software like this
Free during beta