Vulnerability

Medtronic InterStim X and Micro clinician apps can fall back to a default password

MedDevice Cyber Staff · Mar 2 · 2 min read · Via CISA ICSMA-23-061-01

CISA published advisory ICSMA-23-061-01 on March 2, 2023, covering two Medtronic clinician therapy apps: Micro Clinician (A51200) and InterStim X Clinician (A51300). Medtronic reported the issue itself.

CVE-2023-25931 (CWE-620) scores 6.4 under CVSS v3. Under certain reset conditions, the app's custom password can revert to a default password. Anyone holding that default then has the clinician therapy application, which controls more therapy parameters than the patient app.

Two limits keep the score moderate. An attacker needs physical access to the Smart Programmer, and CISA says the flaw is not exploitable remotely. Changes also cannot go outside the therapy parameters already established on the programmer.

Medtronic made an app update available as of February 23, 2023, a week before the advisory, and points users to its security bulletin for the right support contact. A password that silently reverts is worse than no password, because staff keep trusting it.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the Micro Clinician (A51200) and InterStim X Clinician (A51300) apps to the release Medtronic made available on February 23, 2023, which fixes CVE-2023-25931. Use the Medtronic security bulletin to find the right support contact. Keep Smart Programmers under clinic control until every device is updated.

Update the clinician apps. Install the February 23, 2023 Medtronic update on every Smart Programmer running A51200 or A51300.
Secure the Smart Programmers. Exploitation needs physical access, so keep programmers in controlled clinical areas.
Recheck the custom password. After updating, confirm each app still uses its custom password and not the default.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Mobile app Therapy delivery Role-based access

Micro Clinician and InterStim X Clinician apps

PID-3321 User accounts Therapy delivery Role-based access

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

How do I fix CVE-2023-25931 in the Medtronic InterStim X Clinician app?

Install the Medtronic app update available as of February 23, 2023, using the support contact in Medtronic's security bulletin. CISA advisory ICSMA-23-061-01, published March 2, 2023, covers CVE-2023-25931 in the InterStim X Clinician (A51300) and Micro Clinician (A51200) apps.

Can the Medtronic Micro Clinician password reset flaw be exploited remotely?

No. Per CISA advisory ICSMA-23-061-01, CVE-2023-25931 in the Medtronic Micro Clinician (A51200) and InterStim X Clinician (A51300) apps requires physical access to the Smart Programmer, and changes cannot go outside the established therapy parameters.

← Back to Vulnerabilities