Skip to content
OpenAdvisories
Medium ICSMA-18-219-01 2 CVEs

Medtronic MyCareLink 24950 Patient Monitor (Update A)

Published Aug 7, 2018 · Updated May 7, 2026 · Revision 2

Vendor: Medtronic Product: 24950 MyCareLink Monitor Product: 24952 MyCareLink Monitor

Summary

Successful exploitation of these vulnerabilities may allow an attacker with physical access to obtain per-product credentials that are utilized to authenticate data uploads and encrypt data at rest. Additionally, an attacker with access to a set of these credentials and additional identifiers can upload invalid data to the Medtronic CareLink network.

Vulnerabilities 2

  • Medium 5.2
    CVE-2018-10622

    Medtronic MyCareLink Patient Monitor Network Credential Weakness

    Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.

    Medtronic 24952 MyCareLink Monitor 24950 MyCareLink Monitor
  • Medium 4.4
    CVE-2018-10626

    Medtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity

    Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload…

    Medtronic 24950 MyCareLink Monitor 24952 MyCareLink Monitor

Revision history

  1. #2

    Update A - Updated CVE-2018-10622 description and CVSS score and vector score.

  2. #1

    Initial Publication

References