CVE-2020-25183

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Medtronic MyCareLink Smart 25000 contains

an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader and the Medtronic MyCareLink Smart mobile app is vulnerable to bypass. This vulnerability enables an attacker to use another mobile device or malicious application on the patient’s smartphone to authenticate to the patient’s Medtronic Smart Reader, fooling the device into believing it is communicating with the original Medtronic smart phone application when executed within range of Bluetooth communication.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Dec 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-251845.5Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the exe CVE-2020-251858.8The affected product is vulnerable to five post-authentication buffer overflows, which may allow a logged in user to remotely execute arbitr CVE-2020-251867.5An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file d CVE-2020-251879.8Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient read CVE-2020-251887.8An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the ap CVE-2020-251899.8The affected product is vulnerable to three stack-based buffer overflows, which may allow an unauthenticated attacker to remotely execute ar CVE-2020-25194.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected a CVE-2020-251909.8The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party servic CVE-2020-251917.5Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a functi CVE-2020-251925.3The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without prope CVE-2020-251935.3By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08 CVE-2020-251948.8The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an atta