Medtronic MyCareLink 24950 Patient Monitor Storing Passwords in a Recoverable Format
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication and encryption of local data at rest.
Medtronic has made server-side updates to address the insufficient verification vulnerability identified in this advisory. Medtronic is implementing additional server-side mitigations to enhance data integrity and authenticity.
Medtronic recommends users take additional defensive measures to minimize the risk of exploitation. Specifically, users should:
* Maintain good physical control over the home monitor.
* Only use home monitors obtained directly from their healthcare provider or a Medtronic representative to ensure integrity of the system.
Medtronic has released additional patient focused information, at the following location:
https://www.medtronic.com/security
Exploits
Credits
finder
Billy Rios, Jesse Young, and Jonathan Butts of Whitescope LLC reported these vulnerabilities