CVEvulnerability

CVE-2018-14781

5.3 MEDIUM Published 2018-08-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-08-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.0 ([email protected])
5.3 MEDIUM — CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
2.9 LOW — AV:A/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-287, CWE-294

Description

Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.

Affected configurations

• medtronicdiabetes 508 minimed insulin pump firmware • medtronicdiabetes 522 paradigm real-time firmware • medtronicdiabetes 722 paradigm real-time firmware • medtronicdiabetes 523 paradigm revel firmware • medtronicdiabetes 723 paradigm revel firmware • medtronicdiabetes 523k paradigm revel firmware • medtronicdiabetes 723k paradigm revel firmware • medtronicdiabetes 551 minimed 530g firmware • medtronicdiabetes 751 minimed 530g firmware

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-294 Authentication Bypass by Capture-replay weakness

References