Vulnerability · Published Dec 14, 2020 · Assigned by icscert

CVE-2020-25183Medtronic MyCareLink Smart Improper Authentication

High 8.0

In plain English

A high-severity improper authentication in Smart Model 25000 Patient Reader from Medtronic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.8%top 43.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Medtronic MyCareLink Smart 25000 contains an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader and the Medtronic MyCareLink Smart mobile app is vulnerable to bypass. This vulnerability enables an attacker to use another mobile device or malicious application on the patient’s smartphone to authenticate to the patient’s Medtronic Smart Reader, fooling the device into believing it is communicating with the original Medtronic smart phone application when executed within range of Bluetooth communication.

Affected products (as reported)

Vendor	Product	Versions
Medtronic	Smart Model 25000 Patient Reader	All versions

Weakness: CWE-287 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-smart-security-vulnerability-patch.html x_refsource_MISC
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-345-01
https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01 x_refsource_MISC, x_transferred