CVE-2018-10622

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-10622
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication and encryption of local data at rest.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 4.0

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

1.9 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www.securityfocus.com/bid/105042 Third Party Advisory VDB Entry
https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html
https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/105042 Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:medtronic:mycarelink_24952_patient_monitor_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:mycarelink_24952_patient_monitor:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:medtronic:mycarelink_24950_patient_monitor_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:mycarelink_24950_patient_monitor:-:*:*:*:*:*:*:*
History

22 May 2025, 16:15

Type Values Removed Values Added
Summary (en) A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient Monitor. The affected products use per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication and encryption of local data at rest. (en) Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication and encryption of local data at rest.
References
  • () https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html -
CVSS v2 : 1.9
v3 : 7.1 		v2 : 1.9
v3 : 4.9

21 Nov 2024, 03:41

Type Values Removed Values Added
References () http://www.securityfocus.com/bid/105042 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/105042 - Third Party Advisory, VDB Entry
References () https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 - Third Party Advisory, US Government Resource () https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01 - Third Party Advisory, US Government Resource
Information

Published : 2018-08-10 18:29

Updated : 2025-05-22 16:15

NVD link : CVE-2018-10622

Mitre link : CVE-2018-10622

CVE.ORG link : CVE-2018-10622

JSON object : View

Products Affected

medtronic

  • mycarelink_24950_patient_monitor
  • mycarelink_24952_patient_monitor_firmware
  • mycarelink_24952_patient_monitor
  • mycarelink_24950_patient_monitor_firmware
CWE
CWE-257

Storing Passwords in a Recoverable Format

CWE-522

Insufficiently Protected Credentials