Vulnerability

St. Jude Medical Merlin@home transmitters do not verify the Merlin.net endpoint

MedDevice Cyber Staff · Jan 9 · 2 min read · Via CISA ICSMA-17-009-01A

CISA published advisory ICSMA-17-009-01A on January 9, 2017, covering one vulnerability in St. Jude Medical's Merlin@home transmitter. CVE-2017-5149 (CWE-300, Channel Accessible by Non-Endpoint) carries a CVSS v3 base score of 8.9. Affected are the inductive EX1100 models, the EX1100 with MerlinOnDemand capability and the RF EX1150 models, all on transmitter software below version 8.2.2.

The flaw sits in the link between the transmitter and St. Jude Medical's web site, Merlin.net. The identities of the endpoints on that channel are not verified, so a remote attacker who gets onto the path could read or influence the traffic. The vector rates attack complexity high and the integrity and availability impact high, with a scope change.

Version 8.2.2 fixes it, and nobody installs it by hand. St. Jude Medical rolls the update out automatically over several months whenever a transmitter is connected to an Ethernet, WiFi, cellular network or a landline, and recommends keeping the units powered and connected at all times.

A transmitter unplugged in a drawer never receives the fix, so the patch rate depends on patients as much as on the manufacturer. Mutual authentication between a device and its back end belongs in the first release, because retrofitting it costs a months-long rollout.

Are you a representative of Abbott? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Merlin@home transmitter software version 8.2.2 fixes CVE-2017-5149 and is pushed automatically over several months. Transmitters only receive it while powered and connected to Ethernet, WiFi, cellular or a landline. Clinics should tell patients to keep their units plugged in and online.

Keep transmitters powered and connected. The 8.2.2 update arrives automatically only while the unit is online, so an unplugged transmitter stays vulnerable.
Confirm the software version. Check that EX1100 and EX1150 units in the field report version 8.2.2 or later.
Authenticate both ends of the channel. Device makers should verify the server identity on every connection to a cloud back end, and the device identity on the server side.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Cloud connectivity

Contributing

Remote access Field-updatable firmware

Merlin@home transmitter

PID-275 Cloud connectivity Wired network Wireless connectivity Field-updatable firmware

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Names the affected product	No feedback feed from manufacturer

Questions & Answers

What is CVE-2017-5149 in the St. Jude Medical Merlin@home transmitter?

CVE-2017-5149 (CVSS v3 8.9) means the Merlin@home transmitter does not verify the identities of the endpoints on its channel to St. Jude Medical's Merlin.net web site, so a remote attacker could access or influence those communications. CISA covered it in advisory ICSMA-17-009-01A on January 9, 2017.

How do Merlin@home transmitters get the fix for CVE-2017-5149?

St. Jude Medical delivers transmitter software version 8.2.2 automatically over several months to EX1100 and EX1150 Merlin@home transmitters connected to Ethernet, WiFi, cellular or a landline. The company recommends keeping the transmitters powered and connected at all times to receive it.

← Back to Vulnerabilities