CVE-2018-8870

Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove the case of the device, connect to the debug port, and use the password to gain privileged access to the operating system.

Score

CVSS 3.0 6.8 Medium

Status

Modified - ics-cert@hq.dhs.gov

Published

2018-07-03

Last modified

2025-05-22

Weaknesses

CWE-259, CWE-798

Affected products

• 24950 Mycarelink Monitor (Medtronic)
• 24950 Mycarelink Monitor Firmware (Medtronic)
• 24952 Mycarelink Monitor (Medtronic)
• 24952 Mycarelink Monitor Firmware (Medtronic)

References

• https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-6-28-18.html
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01