Vulnerability

Medtronic CareLink 9790, 2090 and Encore 29901 programmers store patient data unencrypted

MedDevice Cyber Staff · Dec 13 · 2 min read · Via CISA ICSMA-18-347-01

CISA published advisory ICSMA-18-347-01 on December 13, 2018, covering three Medtronic programmers: the CareLink 9790, the CareLink 2090 and the 29901 Encore. All versions are affected. Billy Rios and Jonathan Butts of Whitescope LLC reported the issue.

CVE-2018-18984 (CWE-311) is missing encryption of sensitive data. The programmers do not encrypt, or do not sufficiently encrypt, PII and PHI at rest. The CVSS v3 score is 4.6 because the attacker needs physical access to the programmer, and the impact is confidentiality only.

There is no product fix. Medtronic placed the CareLink 9790 into end-of-life status and recommends users stop using it for any purpose. For the 2090 and Encore, which store PHI and PII as part of normal operation, Medtronic recommends keeping data on the programmer for the least time necessary and deleting programmer-generated reports when no longer needed and before any disposition.

Programmers move between clinics, get shipped for service and eventually leave the building. Disposal is where most of this risk lands, so the wipe has to happen before the box goes out the door.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch for CVE-2018-18984. Retire the end-of-life CareLink 9790 entirely, as Medtronic recommends. On the CareLink 2090 and 29901 Encore, keep PHI and PII on the programmer for the least time necessary, delete reports when no longer needed, and follow Medtronic's disposal and retention instructions.

Retire the CareLink 9790. Medtronic recommends no further use of the 9790 for any purpose, so remove it from service.
Delete reports routinely. Manually delete programmer-generated reports on every affected programmer once they are no longer needed.
Control physical custody. Keep programmers in secured locations, since the exposure requires physical access.
Dispose through Medtronic. Contact a Medtronic representative for disposal and retention setting instructions before any programmer leaves your control.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Handles patient data

CareLink Programmer

Handles patient data

29901 Encore Programmer

Handles patient data

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
IonicRF Generator	Abbott	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
LOGIQ e	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
Versana Premier	GE HealthCare	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MONARCH Platform	Johnson & Johnson MedTech	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Evis EUS Endoscopic Ultrasound Center Olympus EU-ME3	Olympus	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Visera Elite III Video System Center Olympus OTV-S700	Olympus	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Optomed Smartscope M5 with Optomed Smartscope FA	Optomed	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Zenition 70	Philips	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
Zenition 90	Philips	Exposed to the same EMB3D threatTID-108	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer

6 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

Which Medtronic programmers are affected by CVE-2018-18984?

CISA advisory ICSMA-18-347-01, published December 13, 2018, lists all versions of the Medtronic CareLink 9790 Programmer, CareLink 2090 Programmer and 29901 Encore Programmer. CVE-2018-18984 means PII and PHI are not encrypted, or not sufficiently encrypted, at rest.

Is there a patch for the Medtronic CareLink 2090 unencrypted data issue?

No product update is listed for CVE-2018-18984 in CISA advisory ICSMA-18-347-01. Medtronic recommends minimizing how long PHI and PII stay on the CareLink 2090 and 29901 Encore programmers, deleting reports when no longer needed, and contacting Medtronic for disposal instructions. The CareLink 9790 is end of life.

Should hospitals still use the Medtronic CareLink 9790 programmer?

No. Per CISA advisory ICSMA-18-347-01 from December 13, 2018, Medtronic placed the CareLink 9790 Programmer into end-of-life status and recommends users no longer use it for any purpose.

← Back to Vulnerabilities