Tandem Mobi insulin pump with interoperable technology
Alternate Controller Enabled Insulin Infusion Pump. Attributes come from Tandem Diabetes Care's own public documentation for this product.
Attributes
Signals
Properties (MITRE EMB3D)
PID-23 Device includes OS/kernel PID-27 Device includes support for firmware/software updates PID-275 Device includes remotely-initiated firmware/software updates PID-31 Application-level software is present and running on the device PID-33 Device includes interactive applications, services, or user interfaces PID-41 Device exposes remote network services PID-411 Device exposes remote services with the ability to send, receive, view or modify sensitive information or configurations
Platform
iOS companion app: iOS app Android iOS
Attributes: component types
API Battery Cloud Service Display Firmware Generic Application Generic Hardware Local Application Local Service Mobile Application Operating System Platform Pump User Interface Web Application
Attributes: interface types
BLE Unknown Wireless
Attributes: assets
Patient Data Sensor Data Software Configuration Software Update Telemetry Data User Data
Attributes: dataflows
Apple Watch to Pump (bolus commands) Automated insulin dosing software to Pump (commands) Automated insulin dosing software to Pump: commands, confirmed back by Pump CGM to Pump (glucose data) CGM to Pump: glucose readings Dexcom G7 CGM to Apple Watch (CGM readings), and Apple Watch to Pump (bolus commands) Dexcom G7 CGM to Pump (CGM glucose values) Dexcom G7 CGM to Tandem Mobi system (glucose data) Mobile App to Pump (basal and bolus programming) Mobile App to Pump: basal and bolus insulin delivery programming, profiles, alert acknowledgement Mobile App to Tandem Cloud (historical pump and mobile app therapy data) Mobile App to Tandem Cloud: historical pump and mobile app therapy data Pump to Apple Watch via Dexcom G7: CGM readings and bolus commands Pump to Mobile App (pump information displayed) Pump to Mobile App (pump information displayed; Mobile App sends commands and programs therapy) Pump to t:connect Mobile App (pump information and status, alerts, alarms) Remote feature updates to Pump t:connect Mobile App to Pump (basal and bolus insulin delivery programming) t:connect Mobile App to Tandem Cloud (historical pump and app therapy data)
Matched threat intel
18
Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what Tandem Diabetes Care has said.
| Advisory | Date | Shared | Tandem Diabetes Care status |
|---|---|---|---|
| Mira’s cloud login accepted any password and returned a session token | Aug 11, 2026 | Same property (MITRE EMB3D)PID-411 | No feedback feed from manufacturer |
| A hard-coded VNC password on a bioreactor, base score 9.8 | May 26, 2026 | Same property (MITRE EMB3D)PID-411 | No feedback feed from manufacturer |
| Cepheid GeneXpert Xpress 6.4a ships without Windows speculative execution mitigations | Mar 11, 2026 | Same property (MITRE EMB3D)PID-23 | No feedback feed from manufacturer |
| A hospital management backend leaked its own system information | Oct 28, 2025 | Same property (MITRE EMB3D)PID-411 | No feedback feed from manufacturer |
| Missing authentication on a DNA sequencer control plane | Oct 21, 2025 | Same property (MITRE EMB3D)PID-411 | No feedback feed from manufacturer |
| A heart pump controller drew a Class I recall with no attacker in sight | Oct 14, 2025 | Same property (MITRE EMB3D)PID-23 | No feedback feed from manufacturer |
| A DICOM viewer that did not check its update server certificate | Feb 20, 2025 | Same property (MITRE EMB3D)PID-275 | No feedback feed from manufacturer |
| MicroDicom DICOM Viewer 2024.03 fails to validate its update server certificate | Feb 6, 2025 | Same property (MITRE EMB3D)PID-27 | No feedback feed from manufacturer |
| A patient monitor with a hidden backdoor that phones home | Jan 30, 2025 | Same property (MITRE EMB3D)PID-27 | No feedback feed from manufacturer |
| Thermo Fisher Xcalibur and Foundation driver packages allow local privilege escalation | Jan 22, 2025 | Same property (MITRE EMB3D)PID-23 | No feedback feed from manufacturer |
| GE Healthcare imaging and ultrasound systems expose default service credentials | Dec 8, 2020 | Same property (MITRE EMB3D)PID-411 | No feedback feed from manufacturer |
| Capsule Technologies SmartLinx Neuron 2 kiosk escapes to admin with a USB keyboard | Jul 14, 2020 | Same property (MITRE EMB3D)PID-23 | No feedback feed from manufacturer |
| GE Healthcare ultrasound systems let a local user escape Kiosk Mode to the operating system | Feb 18, 2020 | Same property (MITRE EMB3D)PID-23 | No feedback feed from manufacturer |
| Medtronic 2090 CareLink and 29901 Encore programmers accept updates without verifying their origin | Feb 27, 2018 | Same property (MITRE EMB3D)PID-27 | No feedback feed from manufacturer |
| Canon Medical holds off on Meltdown and Spectre patches for its diagnostic imaging equipment | Jan 15, 2018 | Same property (MITRE EMB3D)PID-23 | No feedback feed from manufacturer |
| Philips issues WannaCry guidance naming IntelliSpace Portal Workstation IX and Event Management | May 15, 2017 | Same property (MITRE EMB3D)PID-23 | No feedback feed from manufacturer |
| Dario Health glucose monitoring app and servers exposed cross-user health data | Feb 27, 2025 | Same platformAndroid | No feedback feed from manufacturer |
| Medtronic MyCareLink Smart 25000 reader allows Bluetooth authentication bypass and unsigned firmware | Dec 10, 2020 | Same platformiOS 10 | No feedback feed from manufacturer |
Threats and weaknesses in matched advisories
MITRE EMB3D threats
TID-103 Microarchitectural Side Channels TID-116 Latent Privileged Access Port TID-202 Exploitable System Network Stack Component TID-204 Untrusted Programs Can Access Privileged OS Functions TID-205 Existing OS Tools Maliciously Used for Device Manipulation TID-210 Device Vulnerabilities Unpatchable TID-211 Device Allows Unauthenticated Firmware Installation TID-213 Faulty FW/SW Update Integrity Verification TID-215 Unencrypted SW/FW Updates TID-219 OS/Kernel Privilege Escalation TID-222 Critical System Service May Be Disabled TID-224 Excessive Access via Software Diagnostic Features TID-226 Device leaks security information in logs TID-310 Remotely Accessible Unauthenticated Services TID-311 Default Credentials TID-313 Unauthenticated Session Changes Credential TID-314 Passwords Can Be Guessed Using Brute-Force Attempts TID-316 Incorrect Certificate Verification Allows Authentication Bypass TID-319 Cross Site Scripting (XSS) TID-323 Path Traversal TID-324 HTTP Direct Object Reference TID-327 Out of Bounds Memory Access TID-328 Hardcoded Credentials TID-329 Improper Password Storage TID-401 Undocumented Protocol Features TID-406 Unauthorized Messages or Connections TID-407 Missing Message Replay Protection TID-408 Unencrypted Sensitive Data Communication
CWE weaknesses
CWE-1104 Use of Unmaintained Third Party Components CWE-1188 Insecure Default Initialization of Resource CWE-1329 Reliance on Component That is Not Updateable CWE-1390 Weak Authentication CWE-1392 Use of Default Credentials CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-276 Incorrect Default Permissions CWE-284 Improper Access Control CWE-287 Improper Authentication CWE-290 Authentication Bypass by Spoofing CWE-294 Authentication Bypass by Capture-replay CWE-306 Missing Authentication for Critical Function CWE-345 Insufficient Verification of Data Authenticity CWE-427 Uncontrolled Search Path Element CWE-494 Download of Code Without Integrity Check CWE-506 Embedded Malicious Code CWE-522 Insufficiently Protected Credentials CWE-639 Authorization Bypass Through User-Controlled Key CWE-798 Use of Hard-coded Credentials CWE-912 Hidden Functionality