Summary
Successful exploitation of these vulnerabilities may allow an attacker to replay captured wireless communications and cause an insulin (bolus) delivery. This is only possible when non-default options are configured. Additionally, the pump will annunciate this by providing a physical alert, and the user has the capability to suspend the bolus delivery.
Vulnerabilities 2
-
Medium 5.3
Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay
Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote c…
-
Medium 4.8
Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Cleartext Transmission of Sensitive Information
Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker could capture these transmissions and extract sensitive information, such as device serial numbers.
Revision history
-
#2
ICSMA-18-219-02 Medtronic MiniMed MMT-500/MMT-503 Remote Controllers (Update A)
-
#1
ICSMA-18-219-02 Medtronic MiniMed 508 Insulin Pump
References
-
ICS Advisory ICSMA-18-219-02 Web Version
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-219-02
-
Recommended Practices
https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B