CVE-2019-10964 HIGH

CVE-2019-10964: Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control

Vendor Medtronic
Product MiniMed 508 pump
Weakness CWE-284
Published June 28, 2019
Last update May 22, 2025

CVSS base score

7.1/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

What the vulnerability does

01Description

Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.

Key dates

02Disclosure timeline

June 28, 2019 CVE published
May 22, 2025 Record updated