Vulnerability

Insulet Omnipod insulin pump RF link lacks authentication

MedDevice Cyber Staff · Mar 19 · 3 min read · Via CISA ICSMA-20-079-01

CISA published advisory ICSMA-20-079-01 on March 19, 2020, covering the Insulet Omnipod Insulin Management System, product ID/reorder numbers 19191 and 40160 (UDI/model ZXP425, and ZXR425 for the Canadian 10-pack). Thirdwayv Inc and Insulet are credited.

CVE-2020-10627 (CWE-284) scores 7.3 under CVSS v3. The pump communicates over wireless RF with an Insulet-made Personal Diabetes Manager, and that protocol does not properly implement authentication or authorization. An attacker with access to an affected pump may be able to modify or intercept data, change pump settings and control insulin delivery.

CISA notes that the vulnerability is not exploitable remotely; the vector is local with no privileges and no user interaction. The integrity impact is high, which on an insulin pump means dose.

Insulet did not ship a fix for the affected pods. It recommends patients talk to their healthcare provider about the risks of continued use, including changing to the latest model with increased cybersecurity protection, and published patient-focused security bulletins. An RF link that obeys any transmitter on a therapy device is a design-review failure that no field update recovers.

Are you a representative of Insulet? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch for CVE-2020-10627 in the affected Omnipod Insulin Management System. Insulet recommends patients discuss with their healthcare provider the risks of continued use, including changing to the latest model with increased cybersecurity protection. Follow Insulet's published cybersecurity precautions in the meantime.

Review continued use with providers. Have prescribers discuss with each patient whether to move to the latest Omnipod model.
Follow Insulet's precautions. Apply the cybersecurity precautions in Insulet's patient security bulletins.
Keep the PDM with the patient. The flaw is not remotely exploitable, so physical control of the pump and Personal Diabetes Manager limits exposure.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity Therapy delivery

Contributing

Home use

Omnipod Insulin Management System

PID-4111 Wireless connectivity Therapy delivery

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
SafeOp 2: Neural Informatix System	Alphatec Spine	Same signals	No feedback feed from manufacturer
Spectrum IQ Infusion System with Dose IQ Safety Software	Baxter	Same signals	No feedback feed from manufacturer
BD Alaris System with Guardrails Suite MX v12.1.2	BD	Same signals	No feedback feed from manufacturer
EnCor EnCompass Breast Biopsy and Tissue Removal System	BD	Same signals	No feedback feed from manufacturer
Flexiva Pulse Laser Fiber	Boston Scientific	Same signals	No feedback feed from manufacturer
Definium Pace Select	GE HealthCare	Same signals	No feedback feed from manufacturer
Venue Go	GE HealthCare	Same signals	No feedback feed from manufacturer
ProxiDiagnost N90	Philips	Same signals	No feedback feed from manufacturer
Zenition 90	Philips	Same signals	No feedback feed from manufacturer
Accu-Chek Solo micropump system with interoperable technology	Roche	Same signals	No feedback feed from manufacturer
MULTIX Impact, MULTIX Impact C	Siemens Healthineers	Same signals	No feedback feed from manufacturer
Connected OR Hub with Device and Voice Control	Stryker	Same signals	No feedback feed from manufacturer
t:slim X2 insulin pump with interoperable technology	Tandem Diabetes Care	Same signals	No feedback feed from manufacturer

Questions & Answers

What is CVE-2020-10627 in the Insulet Omnipod?

CVE-2020-10627 is improper access control in the wireless RF protocol between the Insulet Omnipod Insulin Management System pump and its Personal Diabetes Manager, which does not properly implement authentication or authorization. CISA advisory ICSMA-20-079-01, published March 19, 2020, scores it 7.3 under CVSS v3.

Can the Insulet Omnipod vulnerability be exploited remotely?

No. CISA advisory ICSMA-20-079-01 states CVE-2020-10627 in the Insulet Omnipod Insulin Management System is not exploitable remotely. An attacker with access to the pump may be able to modify or intercept data, change pump settings and control insulin delivery.

What does Insulet recommend for affected Omnipod users?

Insulet recommends patients using the Omnipod Insulin Management System affected by CVE-2020-10627 talk to their healthcare provider about the risks of continued use, including changing to the latest model with increased cybersecurity protection, per CISA advisory ICSMA-20-079-01 from March 19, 2020.

← Back to Vulnerabilities