CVE-2018-18984 - Medtronic CareLink 2090 Programmer CareLink 9790 Programmer 29901 Encore Programmer, all versions, T

CVE-2018-18984

Summary

Medtronic CareLink 2090 Programmer CareLink 9790 Programmer 29901 Encore Programmer, all versions, The affected products do not encrypt or do not sufficiently encrypt the following sensitive information while at rest PII and PHI.

References

Vulnerable Configurations

cpe:2.3:o:medtronic:carelink_2090_programmer_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:medtronic:carelink_2090_programmer_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:carelink_2090_programmer:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:carelink_2090_programmer:-:*:*:*:*:*:*:*
cpe:2.3:o:medtronic:carelink_9790_programmer_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:medtronic:carelink_9790_programmer_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:carelink_9790_programmer:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:carelink_9790_programmer:-:*:*:*:*:*:*:*
cpe:2.3:o:medtronic:29901_encore_programmer_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:medtronic:29901_encore_programmer_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:29901_encore_programmer:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:29901_encore_programmer:-:*:*:*:*:*:*:*

CVSS

Base:	2.1 (as of 18-09-2020 - 16:54)
Impact:
Exploitability:

CWE

CWE-312

CAPEC

Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:N/A:N

refmap via4

bid	106215
misc	https://ics-cert.us-cert.gov/advisories/ICSMA-18-347-01

Last major update

18-09-2020 - 16:54

Published

14-12-2018 - 15:29

Last modified

18-09-2020 - 16:54