CVE-2018-10622

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-10622
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication and encryption of local data at rest.

7.1 /10

CVSS v3.0 : HIGH

V3 Legend

Vector : AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability : 0.5 / Impact : 6.0

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

1.9 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www.securityfocus.com/bid/105042 Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/105042 Third Party Advisory VDB Entry
https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html
https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 Third Party Advisory US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:medtronic:mycarelink_24952_patient_monitor_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:mycarelink_24952_patient_monitor:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:medtronic:mycarelink_24950_patient_monitor_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:mycarelink_24950_patient_monitor:-:*:*:*:*:*:*:*
History

22 May 2025, 16:15

Type Values Removed Values Added
References
  • () https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html -
References (MISC) https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 - Third Party Advisory, US Government Resource () https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 - Third Party Advisory, US Government Resource
References (BID) http://www.securityfocus.com/bid/105042 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/105042 - Third Party Advisory, VDB Entry
Summary A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient Monitor. The affected products use per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication and encryption of local data at rest. Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication and encryption of local data at rest.
Information

Published : 2018-08-10 18:29

Updated : 2025-05-22 16:15

NVD link : CVE-2018-10622

Mitre link : CVE-2018-10622

JSON object : View

Products Affected

medtronic

  • mycarelink_24950_patient_monitor_firmware
  • mycarelink_24952_patient_monitor
  • mycarelink_24952_patient_monitor_firmware
  • mycarelink_24950_patient_monitor
CWE
CWE-522

Insufficiently Protected Credentials