Summary
Successful exploitation of these vulnerabilities may allow an attacker with physical access to a 2090 Programmer to obtain per-product credentials to the software deployment network. These credentials grant access to the software deployment network, but access is limited to read-only versions of device software applications.
Vulnerabilities 3
-
High 7.1
Medtronic 2090 Carelink Programmer Improper Restriction of Communication Channel to Intended Endpoints
Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this virtual private network before downloading updates. The affected products initially establish an encaps…
-
Medium 4.9
Medtronic 2090 Carelink Programmer Storing Passwords in a Recoverable Format
Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format.
-
Medium 4.8
Medtronic 2090 Carelink Programmer Relative Path Traversal
Medtronic 2090 CareLink Programmer’s software deployment network contains a directory traversal vulnerability that could allow an attacker to read files on the system.
Revision history
-
#4
ICSMA-18-058-01 Medtronic 2090 CareLink Programmer Vulnerabilities (Update C)
-
#3
ICSMA-18-058-01 Medtronic 2090 CareLink Programmer Vulnerabilities (Update B)
-
#2
ICSMA-18-058-01 Medtronic 2090 Carelink Programmer Vulnerabilities (Update A)
-
#1
ICSMA-18-058-01 Medtronic 2090 CareLink Programmer Vulnerabilities
References
-
ICS Advisory ICSMA-18-058-01 Web Version
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-058-01
-
Recommended Practices
https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B