Vulnerability

Medtronic MiniMed insulin pump remote controllers allow replayed bolus commands

MedDevice Cyber Staff · Aug 7 · 3 min read · Via CISA ICSMA-18-219-02

CISA published advisory ICSMA-18-219-02 (Update A) on August 7, 2018, covering the Medtronic MMT-500 and MMT-503 remote controllers and the insulin pumps they pair with: pump models MMT-508, MMT-511, MMT-512/712, MMT-515/715, MMT-522/722, MMT-523/723, the MiniMed 530G (MMT-551/751) and the MiniMed Veo (MMT-554/754). Billy Rios, Jesse Young and Jonathan Butts of Whitescope LLC reported the issues.

CVE-2018-10634 (CWE-319, CVSS v3 4.8) covers the radio link: communications between the pump and wireless accessories go out in cleartext, so a skilled attacker can capture them and extract data such as device serial numbers. CVE-2018-14781 (CWE-294, CVSS v3 5.3) is the one with clinical weight. With a remote paired and the easy bolus and remote bolus options turned on, an attacker can capture the remote's transmissions and replay them to trigger an insulin bolus.

Several conditions narrow the risk. The remote option is off by default, the attacker has to be in radio range, and the pump gives a physical alert that lets the user suspend the bolus.

Medtronic chose withdrawal over a fix. It directed all users to stop using the remote controllers, disable the remote option on the pump and return the remotes, and said it would send letters to patients who may still be using them.

A therapy command that can be replayed off the air is a design defect, and retiring the accessory was the honest answer for hardware that cannot be updated in the field.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no fix; Medtronic withdrew the accessory. Stop using MMT-500 and MMT-503 remote controllers, turn off the remote option on the paired MiniMed pump, and return the remotes to Medtronic. The remote option is off by default, so pumps never paired with a remote are not exposed to the replay attack.

Disable the remote option on the pump. Turning it off removes the pairing that CVE-2018-14781 needs to trigger a bolus.
Return the remote controllers. Send MMT-500 and MMT-503 remotes back to Medtronic as directed rather than storing them for later use.
Leave easy bolus and remote bolus off. Both options are non-default and both must be on for the replay attack to work.
Teach patients the bolus alert. The pump gives a physical alert on delivery, and the user can suspend an unexpected bolus.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity Therapy delivery

Contributing

Home use

MMT-500 and MMT-503 Remote Controller

PID-4112 Wireless connectivity

MiniMed insulin pumps

PID-4112 Wireless connectivity Therapy delivery

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Flexiva Pulse Laser Fiber	Boston Scientific	Same signals	No feedback feed from manufacturer
Zenition 90	Philips	Same signals	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer

Questions & Answers

What is CVE-2018-14781 in Medtronic MiniMed insulin pumps?

CVE-2018-14781 (CVSS v3 5.3) is a capture-replay flaw: when a Medtronic MiniMed pump is paired with an MMT-500 or MMT-503 remote and the non-default easy bolus and remote bolus options are on, an attacker can replay captured transmissions to cause an insulin bolus. CISA covered it in ICSMA-18-219-02 on August 7, 2018.

What did Medtronic tell users of MMT-503 remote controllers to do?

Medtronic directed all users to stop using MMT-500 and MMT-503 remote controllers, disable the remote option on their insulin pump and return the remotes to Medtronic, per CISA advisory ICSMA-18-219-02 of August 7, 2018. The remote option is off by default.

← Back to Vulnerabilities