Vulnerability

Medtronic N'Vision clinician programmer runs code and stores PHI on an unprotected application card

MedDevice Cyber Staff · May 17 · 3 min read · Via CISA ICSMA-18-137-01

CISA published advisory ICSMA-18-137-01 (Update A) on May 17, 2018, covering two vulnerabilities in the Medtronic 8840 N'Vision Clinician Programmer and its 8870 N'Vision removable Application Card, all versions. Billy Rios and Jonathan Butts of Whitescope LLC reported them.

CVE-2018-8849 (CWE-311, CVSS v3 4.6) is missing encryption at rest: the card stores personally identifiable and protected health information without encrypting it. CVE-2018-10631 (CWE-693, CVSS v3 6.3) is the more interesting one. The 8840 executes its application program directly from the 8870 card, so an attacker with physical access and enough skill can modify the binaries on the card, and that code runs the next time the card goes into a programmer.

Both attacks need hands on a card, which keeps the CVSS scores moderate. The design lesson is wider. A programmer that boots whatever executable sits on removable media has handed its integrity to whoever last held the card, and signing that code is the only check that survives a lost card.

Medtronic has not developed a product update. It reinforced security reminders, stated that the 8870 card stores PHI and PII in normal operation and must be secured under applicable patient privacy law, and published patient-focused information at its security page.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no product update for the Medtronic 8840 N'Vision Clinician Programmer or 8870 Application Card. Handle every 8870 card as a store of PHI and PII under patient privacy law, and keep cards in controlled custody so nobody can alter the executables they carry.

Treat 8870 cards as PHI media. Store, track and dispose of Application Cards under the same controls as any other medium holding patient records.
Control physical custody of cards. Both CVEs require physical access to a card, so keep them with the programmer in secured areas and log handoffs.
Replace cards of unknown history. Do not insert a card that has left controlled custody into an 8840 programmer, since its binaries may have been modified.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Removable media

Contributing

Handles patient data

N'Vision Clinician Programmer

PID-123 PID-271 Removable media Handles patient data

Fix the class in your product

The updater does not verify who it talks to or what it installs. As the maker, verify the server certificate and a cryptographic signature on the payload against a device-provisioned key before anything is written. Transport and payload signing are separate controls, and you need both.

Sign the payload. Verify a signature against a key provisioned on the device; refuse unsigned or tampered images.
Verify the server. Validate the full TLS chain and reject a mismatch rather than proceeding.
Block rollback. Refuse downgraded images so an attacker cannot force a known-vulnerable version.

Mapped EMB3D mitigations

Questions & Answers

What are CVE-2018-8849 and CVE-2018-10631 in the Medtronic N'Vision Clinician Programmer?

CVE-2018-8849 (CVSS v3 4.6) means the Medtronic 8870 N'Vision Application Card stores PHI and PII unencrypted. CVE-2018-10631 (CVSS v3 6.3) lets an attacker with physical access modify the card's binaries so malicious code runs in the 8840 Clinician Programmer. CISA covered both in ICSMA-18-137-01 on May 17, 2018.

Is there a patch for the Medtronic 8840 N'Vision Clinician Programmer?

No. Medtronic has not developed a product update for CVE-2018-8849 or CVE-2018-10631 in the 8840 N'Vision Clinician Programmer and 8870 Application Card, all versions. Per CISA advisory ICSMA-18-137-01, it recommends securing the cards as PHI under patient privacy law.

← Back to Vulnerabilities