Medtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity
Vulnerability Description
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLink network.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-10626
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Billy Rios, Jesse Young, and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA.
References
More from Medtronic
View All →Affected Vendor
Medtronic
View all reports →