CISA published advisory ICSMA-18-219-01 on August 7, 2018, later revised as Update A, covering two vulnerabilities in the Medtronic MyCareLink 24950 and 24952 patient monitors. All versions are affected. Billy Rios, Jesse Young and Jonathan Butts of Whitescope LLC reported them.
CVE-2018-10622 (CWE-313, CVSS v3 6.8) is cleartext storage. Each monitor holds per-product credentials, used to authenticate data uploads and to encrypt data at rest, in a recoverable format. An attacker with physical access to a monitor can recover them and use them to modify the encrypted drive data.
CVE-2018-10626 (CWE-345, CVSS v3 4.4) sits on the receiving end of the same flow. The update service does not sufficiently verify the authenticity of uploaded data. An attacker holding per-product credentials from a monitor, plus information about the paired implantable cardiac device, can upload invalid data to the Medtronic CareLink network.
The monitor is a home device that relays data from a patient's implanted cardiac device. Forged uploads would put false readings in front of the clinicians who review them. CISA rates both flaws as high attack complexity and reports no known public exploitation specifically targeting them.
Medtronic addressed the verification flaw with server-side updates and said it is implementing additional server-side mitigations to enhance data integrity and authenticity. No monitor firmware change is listed. Patients are told to maintain good physical control over the home monitor and to use only monitors obtained directly from their healthcare provider or a Medtronic representative.
Server-side validation is the right place to catch forged telemetry, since the credentials already sitting in patients' homes cannot be pulled back.