Vulnerability

Medtronic MiniMed 508 and MiniMed 5xx and 7xx insulin pumps accept unauthenticated radio commands

MedDevice Cyber Staff · Jun 27 · 3 min read · Via CISA ICSMA-19-178-01

CISA published advisory ICSMA-19-178-01 on June 27, 2019, covering a family of Medtronic MiniMed insulin pumps. The list runs from the MiniMed 508 and 511 through the 512/712, 515/715, 522/722, 522K/722K and 712E (all versions), the 523/723 and 523K/723K (2.4A and prior), the Veo 554/754 (2.6A and prior) and the Veo 554CM and 754CM (2.7A and prior).

CVE-2019-10964 (CWE-284) scores 7.1 under CVSS v3. The pumps talk over wireless RF to blood glucose meters, glucose sensor transmitters and CareLink USB devices, and that protocol does not properly implement authentication or authorization. An attacker with adjacent access can inject, replay, modify or intercept data, change pump settings and control insulin delivery.

Credit goes to two research teams: Nathanael Paul, Jay Radcliffe and Barnaby Jack, and Billy Rios, Jonathan Butts and Jesse Young, along with Medtronic. The attack complexity is rated high and the attacker must be within radio range, but the integrity and availability impacts are both high on a device that doses insulin.

A protocol cannot be retrofitted with authentication it never had, so Medtronic is not shipping a fix. It recommends that U.S. patients talk to their healthcare provider about changing to a newer pump with increased cybersecurity protection. Patients outside the U.S. receive a notification letter, and Medtronic is writing to all known users with the risks and defensive measures.

Until a patient switches, the remaining control is distance. The attack needs radio range, so the pump and its linked devices should stay with the patient.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch for CVE-2019-10964. Medtronic recommends U.S. patients on the MiniMed 508 or the other listed MiniMed pumps talk to their healthcare provider about changing to a newer pump with increased cybersecurity protection. Until then, follow Medtronic's patient precautions and keep the pump and its connected devices under the patient's physical control.

Plan pump replacement. Work with the prescribing provider to move patients to a newer Medtronic model with increased cybersecurity protection.
Follow Medtronic's precautions. Apply the cybersecurity precautions Medtronic published for all patients using the affected pumps.
Keep devices in the patient's control. The attacker needs adjacent radio access, so physical custody of the pump and linked devices limits exposure.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity Therapy delivery

Contributing

Home use

MiniMed 508 and MiniMed Paradigm insulin pumps

PID-4111 Wireless connectivity Therapy delivery

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
SafeOp 2: Neural Informatix System	Alphatec Spine	Same signals	No feedback feed from manufacturer
Spectrum IQ Infusion System with Dose IQ Safety Software	Baxter	Same signals	No feedback feed from manufacturer
BD Alaris System with Guardrails Suite MX v12.1.2	BD	Same signals	No feedback feed from manufacturer
EnCor EnCompass Breast Biopsy and Tissue Removal System	BD	Same signals	No feedback feed from manufacturer
Flexiva Pulse Laser Fiber	Boston Scientific	Same signals	No feedback feed from manufacturer
Definium Pace Select	GE HealthCare	Same signals	No feedback feed from manufacturer
Venue Go	GE HealthCare	Same signals	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same signals	No feedback feed from manufacturer
ProxiDiagnost N90	Philips	Same signals	No feedback feed from manufacturer
Zenition 90	Philips	Same signals	No feedback feed from manufacturer
Accu-Chek Solo micropump system with interoperable technology	Roche	Same signals	No feedback feed from manufacturer
MULTIX Impact, MULTIX Impact C	Siemens Healthineers	Same signals	No feedback feed from manufacturer
Connected OR Hub with Device and Voice Control	Stryker	Same signals	No feedback feed from manufacturer
t:slim X2 insulin pump with interoperable technology	Tandem Diabetes Care	Same signals	No feedback feed from manufacturer

Questions & Answers

Which Medtronic MiniMed insulin pumps are affected by CVE-2019-10964?

CISA advisory ICSMA-19-178-01, published June 27, 2019, lists the Medtronic MiniMed 508, 511, 512/712, 515/715, 522/722, 522K/722K and 712E pumps (all versions), the 523/723 and 523K/723K (2.4A and prior), the Veo 554/754 (2.6A and prior) and the Veo 554CM and 754CM (2.7A and prior).

Is there a software fix for the Medtronic MiniMed 508 RF vulnerability?

No. For CVE-2019-10964 in the MiniMed 508 and related MiniMed pumps, Medtronic recommends U.S. patients talk to their healthcare provider about changing to a newer model insulin pump with increased cybersecurity protection, per CISA advisory ICSMA-19-178-01 from June 27, 2019.

What can an attacker do to a Medtronic MiniMed 522 or 722 pump?

Per CISA advisory ICSMA-19-178-01, an attacker with adjacent access can inject, replay, modify or intercept the wireless RF data of affected MiniMed pumps, including the 522/722, and could change pump settings and control insulin delivery. The flaw is CVE-2019-10964, scored 7.1 under CVSS v3.

← Back to Vulnerabilities