Vulnerability

Medtronic 2090 CareLink and 29901 Encore programmers accept updates without verifying their origin

MedDevice Cyber Staff · Feb 27 · 3 min read · Via CISA ICSMA-18-058-01

CISA advisory ICSMA-18-058-01, first published February 27, 2018 and since revised through Update C, covers the Medtronic 2090 CareLink Programmer and the 29901 Encore Programmer, all versions. Billy Rios and Jonathan Butts of Whitescope LLC are credited. The advisory lists three CVEs.

CVE-2018-10596 (CWE-923, CVSS v3 7.1) carries the most weight. The programmers open an IP-based VPN to a Medtronic-hosted update network and then request updates from an HTTP (non-TLS) server across it. The client never checks that the VPN is still up before it sends that request, and the advisory says the products do not verify the origin or integrity of the updates they receive.

An attacker who forces the VPN down can intercept the HTTP request and answer with a malicious update in a man-in-the-middle attack. The design relied on the tunnel for protection that only a signature check on the update itself can give.

The other two rate lower. CVE-2018-5446 (CWE-257, CVSS 4.9) is a per-product username and password stored in a recoverable format, so someone with physical access to a 2090 Programmer could obtain credentials to the software deployment network, limited to read-only versions of device software applications. CVE-2018-5448 (CWE-23, CVSS 4.8) is a directory traversal in the software deployment network that could allow reading files on the system.

Medtronic responded in stages. It disabled the network-based update mechanism, including both the VPN and the HTTP subservices, and told users to apply updates through controlled USB dongles. It later deployed mitigating patches, obtainable through Medtronic Technical Services, and re-enabled network updates. For the stored credential, Medtronic said it would not issue a product update and pointed to compensating controls in the 2090 Programmer Reference Manual.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Medtronic has deployed mitigating patches for the 2090 CareLink and 29901 Encore programmers, available from Medtronic Technical Services, and re-enabled network updates once they were in place. There is no product update for the recoverable stored credential (CVE-2018-5446); Medtronic relies on the compensating controls in the 2090 Programmer Reference Manual. Keep physical control of programmers and apply updates only through Medtronic's supported channel.

Obtain the Medtronic patch. Contact Medtronic Technical Services for the mitigating patch for the 2090 CareLink and 29901 Encore programmers.
Use only the supported update path. Where network updates are not yet patched, apply updates through controlled USB dongles as Medtronic directed.
Keep programmers physically secured. The recoverable credential (CVE-2018-5446) requires physical access to a 2090 Programmer, so store and track the units.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Field-updatable firmware

Contributing

Cloud connectivity USB port

2090 CareLink Programmer

PID-27 PID-271 PID-14 Field-updatable firmware Cloud connectivity USB port

29901 Encore Programmer

PID-271 Field-updatable firmware

Fix the class in your product

The updater does not verify who it talks to or what it installs. As the maker, verify the server certificate and a cryptographic signature on the payload against a device-provisioned key before anything is written. Transport and payload signing are separate controls, and you need both.

Sign the payload. Verify a signature against a key provisioned on the device; refuse unsigned or tampered images.
Verify the server. Validate the full TLS chain and reject a mismatch rather than proceeding.
Block rollback. Refuse downgraded images so an attacker cannot force a known-vulnerable version.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ Insertable Cardiac Monitor	Abbott	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
BD Vaginal Panel	BD	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
XIDF-AWS801, Angio Workstation (Alphenix Workstation), V9.3	Canon Medical	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
CoroFlow Cardiovascular System	Coroventis Research	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Vigilant Software Suite - Vigilant Master Med	Fresenius Kabi	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Automated Aortic Stenosis Software	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Deep Learning Image Reconstruction	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Definium Pace Select	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
LOGIQ e	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
LOGIQ E10s, LOGIQ Fortis	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Spectral Bone Marrow	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Spine Auto Views	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Aptima HCV Quant Dx Assay	Hologic	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer

38 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2018-10596 in the Medtronic 2090 CareLink Programmer?

CVE-2018-10596 (CWE-923, CVSS v3 7.1) affects all versions of the Medtronic 2090 CareLink and 29901 Encore programmers. They fetch updates from an HTTP (non-TLS) server over a VPN without checking the VPN is still connected and without verifying the origin or integrity of the updates, per CISA advisory ICSMA-18-058-01, first published February 27, 2018.

How did Medtronic fix the 2090 CareLink Programmer update vulnerability?

Medtronic first disabled the network-based software update mechanism on the 2090 CareLink and 29901 Encore programmers and directed users to controlled USB dongles. It later deployed mitigating patches through Medtronic Technical Services and re-enabled network updates, according to CISA advisory ICSMA-18-058-01.

← Back to Vulnerabilities