CVE-2018-10626

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLink network.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
Medtronic	24950 MyCareLink Monitor	All versions
Medtronic	24952 MyCareLink Monitor	All versions

References

http://www.securityfocus.com/bid/105042Third Party Advisory, VDB Entry
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2018/icsma-18-219-01.json
https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-219-01
http://www.securityfocus.com/bid/105042Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01Third Party Advisory, US Government Resource

Timeline

Published: Aug 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-106279.8Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions CVE-2018-106289.8AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a CVE-2018-10634.4Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELin CVE-2018-106309.8For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication di CVE-2018-106316.3The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 A CVE-2018-106327.5In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not res CVE-2018-106339.8Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset CVE-2018-106344.8Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker co CVE-2018-106359.8In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code CVE-2018-106368.8CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could caus CVE-2018-106377.8A maliciously crafted project file may cause a buffer overflow, which may allow the attacker to execute arbitrary code that affects Fuji Ele CVE-2018-10647.5libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU