Summary
As part of the intended functionality of this device, it may store protected health information (PHI) or personally identifiable information (PII). Successful exploitation of the vulnerability may allow an attacker with physical access to an affected programmer to access PHI or PII stored on the device.
Vulnerabilities 1
-
Medium 4.6
Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data
Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest .
Revision history
-
#1
ICSMA-18-347-01 Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers
References
-
ICS Advisory ICSMA-18-347-01 Web Version
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-347-01
-
Recommended Practices
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-347-01
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B