Vulnerability

Medtronic lists pacemakers, ICDs and glucose devices as affected by SweynTooth BLE flaws

MedDevice Cyber Staff · Mar 4 · 2 min read · Via Medtronic security disclosure

Medtronic published a bulletin on March 4, 2020 on the SweynTooth Bluetooth Low Energy vulnerabilities, present in some pre-made hardware components. Medtronic lists Azure pacemakers; Percepta, Serena and Solera CRT-P; Cobalt and Crome ICD and CRT-D (CE Mark only); the Guardian Connect glucose sensor transmitter; the Envision Pro glucose recorder; and the MiniMed Connect uploader.

Medtronic states the impact is limited to potential disruption of the communication function and does not affect therapy. SweynTooth is a textbook third-party component problem: the device maker inherits a radio chip vendor's flaw and can only fix it as fast as that vendor ships.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Follow Medtronic's March 4, 2020 SweynTooth bulletin for the listed cardiac and diabetes devices. Expect possible communication interruptions and confirm data transfer completes at follow-up.

Identify affected devices. List patients with the cardiac implants and diabetes devices named in the bulletin.
Watch for dropouts. Treat missed transmissions from these devices as a reason to check the link, then retry.
Track component fixes. Follow Medtronic updates for the affected Bluetooth hardware components.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Off-the-shelf software

Azure pacemakers

Wireless connectivity

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Medtronic devices are affected by SweynTooth?

Medtronic's March 4, 2020 bulletin lists Azure pacemakers, Percepta, Serena and Solera CRT-P, Cobalt and Crome ICD and CRT-D (CE Mark only), the Guardian Connect transmitter, the Envision Pro recorder and the MiniMed Connect uploader.

Does SweynTooth affect therapy on Medtronic pacemakers?

No. Medtronic stated on March 4, 2020 that the SweynTooth BLE vulnerabilities are limited to potential disruption of communication function and do not impact therapy.

← Back to Vulnerabilities