Vulnerability-Lookup

CNVD-2019-21129

Vulnerability from cnvd - Published: 2019-07-04

Title

Medtronic MyCareLink 24950 Patient Monitor和24952 Patient Monitor信息泄露漏洞

Description

Medtronic MyCareLink 24950 Patient Monitor和24952 Patient Monitor都是美国Medtronic公司的用于监测病人生命体征的监护仪设备。 Medtronic MyCareLink 24950 Patient Monitor和24952 Patient Monitor（所有版本）中存在信息泄露漏洞，该漏洞源于程序将凭证存储为可恢复的格式，攻击者可利用该漏洞使用这些凭证进行身份验证并获取敏感信息。

Severity

低

Patch Name

Medtronic MyCareLink 24950 Patient Monitor和24952 Patient Monitor信息泄露漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01

Reference

https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01

Impacted products

Name
['Medtronic MyCareLink Patient Monitor 24950', 'Medtronic MyCareLink Patient Monitor 24952']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-10622"
    }
  },
  "description": "Medtronic MyCareLink 24950 Patient Monitor\u548c24952 Patient Monitor\u90fd\u662f\u7f8e\u56fdMedtronic\u516c\u53f8\u7684\u7528\u4e8e\u76d1\u6d4b\u75c5\u4eba\u751f\u547d\u4f53\u5f81\u7684\u76d1\u62a4\u4eea\u8bbe\u5907\u3002\n\nMedtronic MyCareLink 24950 Patient Monitor\u548c24952 Patient Monitor\uff08\u6240\u6709\u7248\u672c\uff09\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5c06\u51ed\u8bc1\u5b58\u50a8\u4e3a\u53ef\u6062\u590d\u7684\u683c\u5f0f\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7f\u7528\u8fd9\u4e9b\u51ed\u8bc1\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u5e76\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "Billy Rios, Jesse Young, and Jonathan Butts",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-21129",
  "openTime": "2019-07-04",
  "patchDescription": "Medtronic MyCareLink 24950 Patient Monitor\u548c24952 Patient Monitor\u90fd\u662f\u7f8e\u56fdMedtronic\u516c\u53f8\u7684\u7528\u4e8e\u76d1\u6d4b\u75c5\u4eba\u751f\u547d\u4f53\u5f81\u7684\u76d1\u62a4\u4eea\u8bbe\u5907\u3002\r\n\r\nMedtronic MyCareLink 24950 Patient Monitor\u548c24952 Patient Monitor\uff08\u6240\u6709\u7248\u672c\uff09\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5c06\u51ed\u8bc1\u5b58\u50a8\u4e3a\u53ef\u6062\u590d\u7684\u683c\u5f0f\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7f\u7528\u8fd9\u4e9b\u51ed\u8bc1\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u5e76\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Medtronic MyCareLink 24950 Patient Monitor\u548c24952 Patient Monitor\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Medtronic MyCareLink Patient Monitor 24950",
      "Medtronic MyCareLink Patient Monitor 24952"
    ]
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01",
  "serverity": "\u4f4e",
  "submitTime": "2018-08-08",
  "title": "Medtronic MyCareLink 24950 Patient Monitor\u548c24952 Patient Monitor\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2018-10622 (GCVE-0-2018-10622)

Vulnerability from cvelistv5 – Published: 2018-08-10 18:00 – Updated: 2026-06-22 20:42

Title

Medtronic MyCareLink Patient Monitor Network Credential Weakness

Summary

Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.

Severity

5.2 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

CWE

CWE-313

Assigner

icscert icscert root

References

5 references

URL	Tags
https://global.medtronic.com/xg-en/product-securi…
https://www.cisa.gov/news-events/ics-medical-advi…
http://www.securityfocus.com/bid/105042	vdb-entry
https://github.com/cisagov/CSAF/blob/develop/csaf…
https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01	x_refsource_MISCx_transferred

Impacted products

2 products

Vendor	Product	Version
Medtronic	24950 MyCareLink Monitor	Affected: 0 , < February 25, 2026 (custom)
Medtronic	24952 MyCareLink Monitor	Affected: 0 , < February 25, 2026 (custom)

Date Public

2026-05-07 06:00

Credits

Billy Rios, Jesse Young, and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:46:47.036Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105042",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105042"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "24950 MyCareLink Monitor",
          "vendor": "Medtronic",
          "versions": [
            {
              "lessThan": "February 25, 2026",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "24952 MyCareLink Monitor",
          "vendor": "Medtronic",
          "versions": [
            {
              "lessThan": "February 25, 2026",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Billy Rios, Jesse Young, and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA."
        }
      ],
      "datePublic": "2026-05-07T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eMedtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-313",
              "description": "CWE-313",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T20:42:16.327Z",
        "orgId": "3c337f33-b2bd-4529-9792-f48cdb2838b4",
        "shortName": "Medtronic"
      },
      "references": [
        {
          "name": "105042",
          "url": "https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-219-01"
        },
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/105042"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2018/icsma-18-219-01.json"
        }
      ],
      "source": {
        "advisory": "ICSMA-18-219-01",
        "discovery": "EXTERNAL"
      },
      "title": "Medtronic MyCareLink Patient Monitor Network Credential Weakness",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMedtronic recommends users take additional defensive measures to minimize the risk of exploitation. Specifically, users should:\u003c/p\u003e\n\u003cul\u003e\u003cli\u003eMaintain good physical control over the home monitor.\u003c/li\u003e\u003cli\u003eOnly use home monitors obtained directly from their healthcare \nprovider or a Medtronic representative to ensure integrity of the \nsystem.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "Medtronic recommends users take additional defensive measures to minimize the risk of exploitation. Specifically, users should:\n\n\n  *  Maintain good physical control over the home monitor.\n  *  Only use home monitors obtained directly from their healthcare \nprovider or a Medtronic representative to ensure integrity of the \nsystem."
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMedtronic has released additional patient focused information, at the following location:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://www.medtronic.com/security\"\u003ehttps://www.medtronic.com/security\u003c/a\u003e\u003c/p\u003e"
            }
          ],
          "value": "Medtronic has released additional patient focused information, at the following location:\n\n\n\n\n https://www.medtronic.com/security"
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Users should follow CISA\u0027s guidance in the following areas:\u003cbr\u003e\n* \u003ca href=\"https://www.cisa.gov/news-events/news/securing-internet-things-iot\"\u003eSecuring the Internet of Things\u003c/a\u003e\u003cbr\u003e\n* \u003ca href=\"https://www.cisa.gov/news-events/news/home-network-security\"\u003eHome Network Security\u003c/a\u003e"
            }
          ],
          "value": "Users should follow CISA\u0027s guidance in the following areas:\n\n*  Securing the Internet of Things https://www.cisa.gov/news-events/news/securing-internet-things-iot \n\n*  Home Network Security https://www.cisa.gov/news-events/news/home-network-security"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2018-08-07T00:00:00",
          "ID": "CVE-2018-10626",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Medtronic MyCareLink 24950, 24952 Patient Monitor",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ICS-CERT"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient Monitor. The affected product\u0027s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLink network."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "INSUFFICIENT VERIFICATION OF DATA AUTHENTICITY CWE-345"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105042",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105042"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-10622",
    "datePublished": "2018-08-10T18:00:00.000Z",
    "dateReserved": "2018-05-01T00:00:00.000Z",
    "dateUpdated": "2026-06-22T20:42:16.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.