CVE-2017-5149 - An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 (RF models:

CVE-2017-5149

Summary

An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 (RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability). The identities of the endpoints for the communication channel between the transmitter and St. Jude Medical's web site, Merlin.net, are not verified. This may allow a man-in-the-middle attacker to access or influence communications between the identified endpoints.

References

Vulnerable Configurations

cpe:2.3:o:abbott:merlin\@home_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abbott:merlin\@home_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:abbott:merlin\@home_ex1100:-:*:*:*:*:*:*:*
cpe:2.3:h:abbott:merlin\@home_ex1100:-:*:*:*:*:*:*:*
cpe:2.3:h:abbott:merlin\@home_ex1150:-:*:*:*:*:*:*:*
cpe:2.3:h:abbott:merlin\@home_ex1150:-:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 26-06-2023 - 19:38)
Impact:
Exploitability:

CWE

CWE-476

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bid	95331
misc	https://ics-cert.us-cert.gov/advisories/ICSMA-17-009-01A

Last major update

26-06-2023 - 19:38

Published

13-02-2017 - 22:59

Last modified

26-06-2023 - 19:38