CVEvulnerability
CVE-2020-25187
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-12-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-122, CWE-787
Description
Medtronic MyCareLink Smart 25000 is
vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event within the MCL Smart Patient Reader software stack. The heap overflow could allow an attacker to remotely execute code on the MCL Smart Patient Reader, potentially leading to control of the device
Affected configurations
• medtronic mycarelink smart model 25000 firmware
Related
References
- https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-smart-security-vulnerability-patch.html global.medtronic.com
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-345-01 www.cisa.gov
- https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01 Third Party Advisory, US Government Resource