CVE-2018-10631

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 Application Card and sufficient technical capability can modify the contents of this card, including the binary executables. If modified to bypass protection mechanisms, this malicious code will be run when the card is inserted into an 8840 Clinician Programmer.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Medtronic	8840 N’Vision Clinician Programmer	All versions
Medtronic	8870 N’Vision removable Application Card	All versions
ics_cert	medtronic_n_vision_clinician_programmer	>= 8840_n_vision_clinician_programmer, <= *; 8870_n_vision_removable_application_card

References

http://www.securityfocus.com/bid/104213
https://global.medtronic.com/xg-en/product-security/security-bulletins/nvision.html
https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01Third Party Advisory, US Government Resource
https://www.medtronic.com/securityVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01Third Party Advisory, US Government Resource
https://www.medtronic.com/securityVendor Advisory

Timeline

Published: Jul 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-106327.5In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not res CVE-2018-106339.8Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset CVE-2018-106344.8Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker co CVE-2018-106359.8In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code CVE-2018-106368.8CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could caus CVE-2018-106377.8A maliciously crafted project file may cause a buffer overflow, which may allow the attacker to execute arbitrary code that affects Fuji Ele CVE-2018-10647.5libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU CVE-2018-106418.1D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext.CVE-2018-106427.2Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing t CVE-2018-106457.8Golden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "VyprVPN" service. This ser CVE-2018-106467.8CyberGhost 6.5.0.3180 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "CG6Service" service. This service es CVE-2018-106477.8SaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "SaferVPN.Service" service. The "SaferVPN.Service