Back to Database
Status published
Medium
CVE-2018-8849
Medtronic N'Vision Clinician Programmer Missing Encryption of Sensitive Data
Vulnerability Description
Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-8849
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Billy Rios and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA.
References
More from Medtronic
View All →CVE-2025-4397
Medtronic MyCareLink Patient Monitor Data Encryption Weakness
Medium
6.8
CVE-2025-4395
Medtronic MyCareLink Patient Monitor Empty Password Vulnerability
Medium
6.8
CVE-2025-4394
Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability
Medium
6.8
CVE-2025-4393
Medtronic MyCareLink Patient Monitor Deserialization Vulnerability
Medium
6.5
CVE-2025-4386
Medtronic MyCareLink Patient Monitor Hardware Debug Port
Medium
6.8
Affected Vendor
Medtronic
View all reports →Affected Software
N'Vision Clinician Programmer, 8870 N’Vision removable Application Card
Vulnerable Versions:
all versions
Timeline
Official Publish:
May 18th, 2018
Last Modified:
June 27th, 2025
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N