ByteOS Network

NVD Vulnerability Details :

CVE-2020-27252

Modified

Source-ics-cert@hq.dhs.gov

Published At-14 Dec, 2020 | 20:15

Updated At-22 May, 2025 | 20:15

Medtronic MyCareLink Smart 25000 is vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited, an attacker could remotely execute code on the MCL Smart Patient Reader device, leading to control of the device.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary	3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

medtronic>>mycarelink_smart_model_25000_firmware>>*

cpe:2.3:o:medtronic:mycarelink_smart_model_25000_firmware:*:*:*:*:*:*:*:*

medtronic>>mycarelink_smart_model_25000>>-

cpe:2.3:h:medtronic:mycarelink_smart_model_25000:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-367	Secondary	ics-cert@hq.dhs.gov
CWE-367	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-smart-security-vulnerability-patch.html	ics-cert@hq.dhs.gov	N/A
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-345-01	ics-cert@hq.dhs.gov	N/A
https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History