CVE-2018-18984

Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest .

Score

CVSS 3.1 4.6 Medium

Status

Modified - ics-cert@hq.dhs.gov

Published

2018-12-14

Last modified

2025-05-22

Weaknesses

CWE-311, CWE-312

Affected products

• 29901 Encore Programmer (Medtronic)
• 29901 Encore Programmer Firmware (Medtronic)
• Carelink 2090 Programmer (Medtronic)
• Carelink 2090 Programmer Firmware (Medtronic)
• Carelink 9790 Programmer (Medtronic)
• Carelink 9790 Programmer Firmware (Medtronic)

References

• http://www.securityfocus.com/bid/106215
• https://global.medtronic.com/xg-en/product-security/security-bulletins/carelink-9790-2090-29901.html
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-347-01