CVE-2018-14781 - CVE House
Back to Database
Status published Medium CVE-2018-14781

Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay

Vulnerability Description

Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-14781

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Billy Rios, Jesse Young, and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA.

References

More from Medtronic

View All →
CVE-2025-4397
Medtronic MyCareLink Patient Monitor Data Encryption Weakness
Medium 6.8
CVE-2025-4395
Medtronic MyCareLink Patient Monitor Empty Password Vulnerability
Medium 6.8
CVE-2025-4394
Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability
Medium 6.8
CVE-2025-4393
Medtronic MyCareLink Patient Monitor Deserialization Vulnerability
Medium 6.5
CVE-2025-4386
Medtronic MyCareLink Patient Monitor Hardware Debug Port
Medium 6.8

Affected Vendor

Affected Software

MMT- 508 - MiniMed pump, MMT – 511 pump Paradigm, MMT – 512 / MMT – 712 Paradigm x12, MMT – 515 / MMT – 715 Paradigm x15, MMT – 522 / MMT – 722 Paradigm REAL-TIME, MMT – 522(K) / MMT – 722(K) Paradigm REAL-TIME, MMT – 523 / MMT – 723 Paradigm Revel, MMT – 523(K) / MMT – 723(K) Paradigm, MMT – 554 / MMT – 754 MiniMed Veo, MMT – 551 / MMT – 751 MiniMed 530G
Vulnerable Versions:
All versions

Timeline

Official Publish: August 13th, 2018
Last Modified: May 22nd, 2025
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-294

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.