CVE-2018-10634

Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker could capture these transmissions and extract sensitive information, such as device serial numbers.

Score

CVSS 3.0 5.3 Medium

Status

Modified - ics-cert@hq.dhs.gov

Published

2018-08-13

Last modified

2025-05-22

Weaknesses

CWE-319

Affected products

• Minimed 530g Mmt-551 Firmware (Medtronic)
• Minimed 530g Mmt-751 Firmware (Medtronic)
• Minimed Paradigm 508 Insulin Pump Firmware (Medtronic)
• Minimed Paradigm Real-time Mmt-522 Firmware (Medtronic)
• Minimed Paradigm Real-time Mmt-722 Firmware (Medtronic)
• Minimed Paradigm Revel Mmt-523 Firmware (Medtronic)
• Minimed Paradigm Revel Mmt-523k Firmware (Medtronic)
• Minimed Paradigm Revel Mmt-723 Firmware (Medtronic)
• Minimed Paradigm Revel Mmt-723k Firmware (Medtronic)
• Mmt- 508 - Minimed Pump (Medtronic)
• Mmt 511 Pump Paradigm (Medtronic)
• Mmt 512 Mmt 712 Paradigm X12 (Medtronic)
• Mmt 515 Mmt 715 Paradigm X15 (Medtronic)
• Mmt 522 Mmt 722 Paradigm Real-time (Medtronic)
• Mmt 522k Mmt 722k Paradigm Real-time (Medtronic)
• Mmt 523 Mmt 723 Paradigm Revel (Medtronic)
• Mmt 523k Mmt 723k Paradigm (Medtronic)
• Mmt 551 Mmt 751 Minimed 530g (Medtronic)
• Mmt 554 Mmt 754 Minimed Veo (Medtronic)

References

• http://www.securityfocus.com/bid/105044
• https://global.medtronic.com/xg-en/product-security/security-bulletins/minimed.html
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-02