Back to Database
Status published
Medium
CVE-2018-18984
Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data
Vulnerability Description
Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest .
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-18984
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Researchers Billy Rios and Jonathan Butts of Whitescope LLC reported this vulnerability
References
More from Medtronic
View All →CVE-2025-4397
Medtronic MyCareLink Patient Monitor Data Encryption Weakness
Medium
6.8
CVE-2025-4395
Medtronic MyCareLink Patient Monitor Empty Password Vulnerability
Medium
6.8
CVE-2025-4394
Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability
Medium
6.8
CVE-2025-4393
Medtronic MyCareLink Patient Monitor Deserialization Vulnerability
Medium
6.5
CVE-2025-4386
Medtronic MyCareLink Patient Monitor Hardware Debug Port
Medium
6.8
Affected Vendor
Medtronic
View all reports →Affected Software
CareLink 9790 Programmer, CareLink 2090 Programmer, 29901 Encore Programmer
Vulnerable Versions:
All versions
Timeline
Official Publish:
December 14th, 2018
Last Modified:
May 22nd, 2025
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N