Vulnerability CVE-2018-5446


Published: 2018-05-04

Description:
All versions of the Medtronic 2090 Carelink Programmer are affected by a per-product username and password that is stored in a recoverable format which could allow an attacker with physical access to a 2090 Programmer to obtain per-product credentials to the software deployment network.

Type:

CWE-522

(Insufficiently Protected Credentials)

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.1/10
2.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Medtronic -> 2090 carelink programmer firmware 

 References:
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-01

Copyright 2022, cxsecurity.com

 

Back to Top