Summary
Successful exploitation of these vulnerabilities could allow an attacker with physical access to the CardioMessenger to obtain sensitive data, obtain transmitted medical data from implanted cardiac devices with the implant 's serial number or impact Cardio Messenger II product functionality. Successful exploitation of these vulnerabilities could allow an attacker with adjacent access to influence communications between the Home Monitoring Unit (HMU) and the Access Point Name (APN) gateway network.
Vulnerabilities 5
-
Unscored —
BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Re…
-
Unscored —
BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypt…
-
Unscored —
BIOTRONIK CardioMessenger II, The affected products allow credential reuse for multiple authentication purposes. An att…
-
Unscored —
BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker wit…
-
Unscored —
BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recovera…
Revision history
-
#1
ICSMA-20-170-05 BIOTRONIK Cardio Messenger II
References
-
ICS Advisory ICSMA-20-170-05 Web Version
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-170-05
-
Recommended Practices
https://www.fda.gov/medical-devices/digital-health/cybersecurity
-
Recommended Practices
https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B