Summary
As part of the normal functionality of this device, the N 'Vision Clinician Programmer may store Personal Health Information (PHI) or Personal Identifying Information (PII). Successful exploitation of these vulnerabilities may allow an attacker with physical access to an 8870 N 'Vision Compact Flash card to access this PHI or PII.
Vulnerabilities 2
-
Medium 6.3
Medtronic N'Vision Clinician Programmer Protection Mechanism Failure
The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 Application Card and sufficient technical capability can modify the contents of this card, including the binary executab…
-
Medium 4.6
Medtronic N'Vision Clinician Programmer Missing Encryption of Sensitive Data
Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest.
Revision history
-
#2
ICSMA-18-137-01 Medtronic N'Vision Clinician Programmer (Update A)
-
#1
ICSMA-18-137-01 Medtronic N'Vision Clinician Programmer
References
-
ICS Advisory ICSMA-18-137-01 Web Version
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-137-01
-
Recommended Practices
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-137-01
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf