Vulnerability

Medtronic MyCareLink Smart 25000 reader allows Bluetooth authentication bypass and unsigned firmware

MedDevice Cyber Staff · Dec 10 · 3 min read · Via CISA ICSMA-20-345-01

CISA published advisory ICSMA-20-345-01 on December 10, 2020, covering three vulnerabilities in the Medtronic MyCareLink Smart Model 25000 Patient Reader, all versions. Sternum, based in Tel Aviv, Israel, reported them.

CVE-2020-25183 (CWE-287, CVSS v3 8.0) breaks the pairing. The method used to authenticate between the reader and the MyCareLink Smart mobile app can be bypassed, so another mobile device or a malicious app on the patient's smartphone can convince the reader it is talking to the genuine Medtronic app. The attacker has to be within Bluetooth range.

CVE-2020-25187 (CWE-122, CVSS v3 8.8) is a heap-based buffer overflow. An authenticated attacker sends a debug command to the reader, overflows the heap in its software stack and can execute code remotely. CVE-2020-27252 (CWE-367, CVSS v3 8.8) is a time-of-check time-of-use race in the reader's software update system that allows unsigned firmware to be uploaded and executed.

Chained, the three give an attacker in Bluetooth range a path from impersonating the app to running code on the reader. CISA's risk evaluation says that could let an attacker modify or fabricate implanted cardiac device data uploaded to the CareLink Network and could allow control of a paired cardiac device. Medtronic said it was unaware of any cyberattack, privacy breach or patient harm from these flaws.

The fix ships through the phone. Medtronic released a firmware update delivered by updating the MyCareLink Smart app to version 5.2 from the app store, and the reader updates on next use. The phone must run iOS 10 or later or Android 6.0 or later for the patch to apply. Medtronic also added controls for monitoring and responding to improper use of the reader.

A debug command that answers after pairing is a production defect. Strip diagnostic handlers before the device ships.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the MyCareLink Smart app to version 5.2; the Model 25000 Patient Reader receives the firmware fix on its next use. Phones must run iOS 10 or later or Android 6.0 or later for the patch to apply. Patients should report any concerning behavior to their healthcare provider or a Medtronic representative.

Update the app to 5.2. Install MyCareLink Smart version 5.2 from the app store so the reader is patched on next use.
Bring the phone up to date. The patch applies only on iOS 10 or later or Android 6.0 or later.
Report odd behavior. Patients should tell their healthcare provider or a Medtronic representative about anything concerning.
Remove debug handlers before release. Diagnostic commands reachable over Bluetooth after pairing give an attacker a code execution path.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Mobile app Field-updatable firmware Cloud connectivity Home use

MyCareLink Smart Patient Reader

PID-271 PID-22 Wireless connectivity Mobile app Field-updatable firmware Cloud connectivity

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same platformAndroid 6.0	No feedback feed from manufacturer
FreeStyle Libre 2 Flash Glucose Monitoring System	Abbott	Same platformiOS 10	No feedback feed from manufacturer
Stelo Glucose Biosensor System	DexCom	Same platformiOS app	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same platformAndroid 6.0	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same platformAndroid 6.0	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Same platformiOS 10	No feedback feed from manufacturer
TipTraQ	Pranaq	Same platformAndroid 6.0	No feedback feed from manufacturer
All-Day Clear Slim ADCS1 Hearing Aid. All-Day Clear ADC1 Hearing Aid	Sonova	Same platformAndroid 6.0	No feedback feed from manufacturer
Connected OR Hub with Device and Voice Control	Stryker	Same platformiOS app	No feedback feed from manufacturer
SDC3 HD Information Management System with Wireless Device Control	Stryker	Same platformiOS app	No feedback feed from manufacturer
Tandem Mobi insulin pump with interoperable technology	Tandem Diabetes Care	Same platformiOS 10	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Same platformAndroid 6.0	No feedback feed from manufacturer
WSA Self-Fitting Hearing Aid Gen 2	WS Audiology	Same platformAndroid 6.0	No feedback feed from manufacturer
LUX-Dx Insertable Cardiac Monitor	Boston Scientific	Same attributes (interface and component types)Bluetooth, Mobile Application	No feedback feed from manufacturer
Zio AT device	iRhythm	Same attributes (interface and component types)Bluetooth, Cloud Service	No feedback feed from manufacturer

2 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

How do I patch the Medtronic MyCareLink Smart 25000 reader vulnerabilities?

Update the MyCareLink Smart mobile app to version 5.2 from the app store; the Model 25000 Patient Reader receives the firmware fix on next use. The phone must run iOS 10 or later or Android 6.0 or later. The update addresses CVE-2020-25183, CVE-2020-25187 and CVE-2020-27252 from CISA advisory ICSMA-20-345-01, published December 10, 2020.

Can CVE-2020-25183 in Medtronic MyCareLink Smart be exploited remotely?

Only within Bluetooth range. CISA advisory ICSMA-20-345-01 says exploitation of CVE-2020-25183 (CVSS v3 8.0), an authentication bypass between the MyCareLink Smart Model 25000 Patient Reader and its mobile app, must be initiated within Bluetooth signal proximity of the reader.

Who found the Medtronic MyCareLink Smart vulnerabilities?

Sternum, based in Tel Aviv, Israel, reported CVE-2020-25183, CVE-2020-25187 and CVE-2020-27252 in the Medtronic MyCareLink Smart Model 25000 Patient Reader, according to CISA advisory ICSMA-20-345-01 published December 10, 2020.

← Back to Vulnerabilities