Vulnerability

Medtronic MiniMed 600 series pumps expose pairing protocol details to nearby attackers

MedDevice Cyber Staff · Sep 20 · 2 min read · Via CISA ICSMA-22-263-01

CISA published advisory ICSMA-22-263-01 on September 20, 2022, covering CVE-2022-32537 in Medtronic's NGP 600 series insulin pumps. Affected are the MiniMed 620G, 630G, 640G and 670G across a set of MMT model numbers. Medtronic reported the issue itself.

The flaw is a protection mechanism failure (CWE-693) in pairing. While the pump is being paired with other system components, an unauthorized user could learn aspects of the communication protocol those components use.

The consequence is clinical. Per the risk evaluation, successful exploitation could let an unauthorized user deliver too much or too little insulin, either through an unintended bolus or by slowing or stopping delivery.

The bar is high, which is why the CVSS v3 score is only 4.8. The attacker needs nearby wireless signal proximity to the patient and the device, low privileges and advanced technical knowledge, and has to catch the pairing window. The vector rates integrity impact high and confidentiality and availability none.

Medtronic's precautions center on the remote bolus feature: turning it off ensures no remote bolus is possible. Pairing is the moment a therapy device is most exposed, so do it somewhere private and keep it short.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The advisory names no software fix for CVE-2022-32537 in the MiniMed 620G, 630G, 640G and 670G. Medtronic's precautions apply instead: turning off the remote bolus feature ensures no remote bolus is possible. Exploitation needs wireless proximity during pairing, so pairing should happen away from strangers.

Turn off remote bolus. Medtronic says this ensures no remote bolus is possible on the affected pumps.
Pair in a private setting. The attacker has to be in wireless range while the pump pairs with other system components.
Follow Medtronic's precautions. Apply the user precautions Medtronic published with ICSMA-22-263-01.
Protect the pairing exchange. Device makers should design pairing so an observer in range learns nothing that lets them issue commands later.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity Therapy delivery

MiniMed 600 series insulin pump

Wireless connectivity Therapy delivery

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Vigilant Software Suite - Vigilant Master Med	Fresenius Kabi	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Accu-Chek Solo micropump system with interoperable technology	Roche	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
All-Day Clear Slim ADCS1 Hearing Aid. All-Day Clear ADC1 Hearing Aid	Sonova	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Connected OR Hub with Device and Voice Control	Stryker	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Connected OR Hub with Voice Control	Stryker	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Basal-IQ Technology	Tandem Diabetes Care	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
BlueStar Rx	Welldoc	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Flexiva Pulse Laser Fiber	Boston Scientific	Same signals	No feedback feed from manufacturer
Definium Pace Select	GE HealthCare	Same signals	No feedback feed from manufacturer
Venue Go	GE HealthCare	Same signals	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Same signals	No feedback feed from manufacturer
ProxiDiagnost N90	Philips	Same signals	No feedback feed from manufacturer

1 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2022-32537 in Medtronic MiniMed 600 series insulin pumps?

CVE-2022-32537 (CVSS 4.8) lets an unauthorized user in wireless range learn aspects of the communication protocol while a Medtronic MiniMed 620G, 630G, 640G or 670G pump is being paired, which could lead to too much or too little insulin delivery. CISA covered it in advisory ICSMA-22-263-01 on September 20, 2022.

How can MiniMed 600 series users block the CVE-2022-32537 remote bolus risk?

Medtronic says turning off the remote bolus feature on MiniMed 620G, 630G, 640G and 670G pumps ensures no remote bolus is possible, per CISA advisory ICSMA-22-263-01. Exploitation also requires the attacker to be within wireless range during pairing.

← Back to Vulnerabilities