CVE-2020-25183

{"id": "CVE-2020-25183", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2020-12-14T20:15:12.590", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Medtronic MyCareLink Smart 25000 all versions contain an authentication protocol vuln where the method used to auth between MCL Smart Patient Reader and MyCareLink Smart mobile app is vulnerable to bypass. This vuln allows attacker to use other mobile device or malicious app on smartphone to auth to the patient\u2019s Smart Reader, fools the device into thinking its communicating with the actual smart phone application when executed in range of Bluetooth."}, {"lang": "es", "value": "Todas las versiones de Medtronic MyCareLink Smart 25000 contienen una vulnerabilidad del protocolo de autenticaci\u00f3n donde el m\u00e9todo usado para la autenticaci\u00f3n entre MCL Smart Patient Reader y la aplicaci\u00f3n m\u00f3vil MyCareLink Smart es vulnerable a una omisi\u00f3n. Esta vulnerabilidad permite al atacante usar otro dispositivo m\u00f3vil o aplicaci\u00f3n maliciosa en el tel\u00e9fono inteligente para autenticarse en el Smart Reader del paciente, enga\u00f1a al dispositivo para que crea que se est\u00e1 comunicando con la aplicaci\u00f3n real del tel\u00e9fono inteligente cuando se ejecutaba en el alcance del Bluetooth."}], "lastModified": "2020-12-15T15:20:29.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:medtronic:mycarelink_smart_model_25000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E4540F2-921F-4B45-9C30-D1E3F7BE741F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:medtronic:mycarelink_smart_model_25000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "06DAC262-42EB-440C-A2B2-3A24A88C05B0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}