CVE-2018-8849

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
Medtronic	N'Vision Clinician Programmer	all versions
Medtronic	8870 N’Vision removable Application Card	all versions

References

http://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/Medtronic-NVision-8840_Security-Bulletin_FINAL.pdfVendor Advisory
http://www.securityfocus.com/bid/104213Third Party Advisory, VDB Entry
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-137-01
https://www.medtronic.com/security
http://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/Medtronic-NVision-8840_Security-Bulletin_FINAL.pdfVendor Advisory
http://www.securityfocus.com/bid/104213Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01Third Party Advisory, US Government Resource

Timeline

Published: May 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-88509.8Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not validate input properly, allowing an attacker to cr CVE-2018-88519.8Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions CVE-2018-88528.8Philips e-Alert Unit (non-medical device), Version R2.1 and prior. When authenticating a user or otherwise establishing a new user session, CVE-2018-88538.8Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating system. Windows boots by CVE-2018-88547.5Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not properly restrict the size or amount of resources r CVE-2018-88559.8Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions CVE-2018-88569.8Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software contains hard-coded cryptographic key, which it uses for enc CVE-2018-88577.8Philips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.CVE-2018-88589.8If an attacker has access to the firmware from the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) the CVE-2018-88599.8Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions CVE-2018-88606.5In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker may be able to capture firmware updates through the adjacent network.CVE-2018-88618.7Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and