Vulnerability · Published Jan 19, 2021 · Assigned by icscert
CVE-2020-27272
Medium 5.7
In plain English
A medium-severity security flaw in SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS NVD)5.7Medium
Exploit odds (30 days)0.5%top 58.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SOOIL Developments CoLtd DiabecareRS, AnyDana-i, AnyDana-A, The communication protocol of the insulin pump and AnyDana-i,AnyDana-A mobile apps doesn't use adequate measures to authenticate the pump before exchanging keys, which allows unauthenticated, physically proximate attackers to eavesdrop the keys and spoof the pump via BLE.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A | Dana Diabecare RS,AnyDana-i,AnyDana-A versions prior to 3.0 |
References
- https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01 x_refsource_MISC