CVE-2020-25183
CVSS V2 Medium 5.8
CVSS V3 High 8.8
Description
Medtronic MyCareLink Smart 25000 all versions contain an authentication protocol vuln where the method used to auth between MCL Smart Patient Reader and MyCareLink Smart mobile app is vulnerable to bypass. This vuln allows attacker to use other mobile device or malicious app on smartphone to auth to the patient’s Smart Reader, fools the device into thinking its communicating with the actual smart phone application when executed in range of Bluetooth.
Overview
- CVE ID
- CVE-2020-25183
- Assigner
- ics-cert@hq.dhs.gov
- Vulnerability Status
- Analyzed
- Published Version
- 2020-12-14T20:15:12
- Last Modified Date
- 2020-12-15T15:20:29
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:o:medtronic:mycarelink_smart_model_25000_firmware:*:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:h:medtronic:mycarelink_smart_model_25000:-:*:*:*:*:*:*:* | 0 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:A/AC:L/Au:N/C:P/I:P/A:P
- Access Vector
- ADJACENT_NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 5.8
- Severity
- MEDIUM
- Exploitability Score
- 6.5
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- ADJACENT_NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 8.8
- Base Severity
- HIGH
- Exploitability Score
- 2.8
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01 | Third Party Advisory US Government Resource |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2020-25183 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25183 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 07:30:21 | Added to TrackCVE | |||
| 2022-12-05 18:11:03 | 2020-12-14T20:15Z | 2020-12-14T20:15:12 | CVE Published Date | updated |
| 2022-12-05 18:11:03 | 2020-12-15T15:20:29 | CVE Modified Date | updated | |
| 2022-12-05 18:11:03 | Analyzed | Vulnerability Status | updated |