CVE-2016-5085

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof meters by sniffing the network and then engaging in an authentication handshake.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.kb.cert.org/vuls/id/884840Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/BLUU-A9SQRSThird Party Advisory, US Government Resource
http://www.securityfocus.com/bid/93351
https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pumpMitigation, Technical Description, Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01
http://www.kb.cert.org/vuls/id/884840Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/BLUU-A9SQRSThird Party Advisory, US Government Resource
http://www.securityfocus.com/bid/93351
https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pumpMitigation, Technical Description, Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01

Timeline

Published: Oct 5, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-50869.8Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks.CVE-2016-50874.4Alertus Desktop Notification before 2.9.31.1710 on OS X uses weak permissions for configuration files and unspecified other files, which all CVE-2016-50918.1Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execut CVE-2016-50924.9Directory traversal vulnerability in Fortinet FortiWeb before 5.5.3 allows remote authenticated administrators with read and write privilege CVE-2016-50938.6The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does CVE-2016-50948.6Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attacke CVE-2016-50958.6Integer overflow in the php_escape_html_entities_ex function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remo CVE-2016-50968.6Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause CVE-2016-50975.3phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows CVE-2016-50985.3Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determi CVE-2016-50996.1Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitr CVE-2016-51009.8Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the passw