Vulnerability

Medtronic MyCareLink monitors expose a debug port with a hard-coded OS password

MedDevice Cyber Staff · Jun 28 · 3 min read · Via CISA ICSMA-18-179-01

CISA published advisory ICSMA-18-179-01 on June 28, 2018, covering two vulnerabilities in the Medtronic MyCareLink 24950 and 24952 patient monitors, all versions. Peter Morgan of Clever Security reported them.

CVE-2018-8870 (CWE-259, CVSS v3 6.4) is a hard-coded operating system password. An attacker with physical access removes the case, connects to the debug port and uses that password to gain privileged access to the operating system.

CVE-2018-8868 (CWE-749, CVSS 6.2) is debug code left in the product to test the monitor's communication interfaces, including the link to the implantable cardiac device. Reached through the first flaw, that code can read and write arbitrary memory values on an implanted cardiac device over inductive or short range wireless protocols, provided the attacker is in close physical proximity to it.

Both scores stay moderate because the attack chain starts with opening a physical unit. The second step is what raises the stakes, since the target is memory on a device inside a patient.

Medtronic is releasing several rolling over-the-air updates that apply automatically through its standard update process, and it has increased security monitoring of the affected devices and related infrastructure. Test code that can write implant memory has no place in a shipped monitor.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Medtronic is mitigating CVE-2018-8870 and CVE-2018-8868 in MyCareLink 24950 and 24952 monitors with rolling over-the-air updates that install automatically. Patients and clinics need no manual step beyond keeping the monitor in service and in their control. Both flaws require physical access to the unit.

Keep monitors in normal service. The fixes arrive as automatic over-the-air updates through Medtronic's standard update process.
Keep units in the patient's control. Exploitation starts with opening the case, so a monitor that leaves the patient's hands should be treated as suspect.
Strip debug code and ports before release. Device makers should remove test functions that can write implant memory and disable or lock the debug port in production units.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Wireless connectivity Field-updatable firmware

MyCareLink Monitor

PID-15 PID-22 PID-3321 PID-275 Wireless connectivity Field-updatable firmware

Fix the class in your product

A production device ships with a debug interface live and reachable. As the maker, disable or fuse-lock the debug interface before the device ships, provision unique secrets rather than embedded ones, encrypt every link, and authenticate the paths that change device behavior.

Fuse-lock debug ports. Permanently disable JTAG and SWD at production boot; verify per unit as a manufacturing gate.
Engage readout protection. Enable hardware readout protection so flash cannot be dumped.
Authenticate control paths. No maintenance path bypasses authentication on commands that change behavior.

Mapped EMB3D mitigations

Questions & Answers

What are CVE-2018-8870 and CVE-2018-8868 in the Medtronic MyCareLink monitor?

CVE-2018-8870 (CVSS 6.4) is a hard-coded operating system password reachable through the debug port of Medtronic MyCareLink 24950 and 24952 monitors. CVE-2018-8868 (CVSS 6.2) is debug code that can read and write arbitrary memory on a nearby implantable cardiac device. CISA covered both in ICSMA-18-179-01 on June 28, 2018.

Does an attacker need physical access to exploit the Medtronic MyCareLink flaws?

Yes. Per CISA advisory ICSMA-18-179-01, exploiting CVE-2018-8870 requires removing the MyCareLink monitor's case and connecting to its debug port, and using the debug functionality of CVE-2018-8868 against an implant requires close physical proximity to the implantable cardiac device.

How is Medtronic fixing the MyCareLink 24950 and 24952 vulnerabilities?

Medtronic is releasing several rolling over-the-air updates for MyCareLink 24950 and 24952 monitors that apply automatically as part of its standard update process, and it has increased security monitoring of affected devices and infrastructure, per CISA advisory ICSMA-18-179-01.

← Back to Vulnerabilities