Medtronic MyCareLink Smart 25000 all versions are vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited an attacker could remotely execute code on the MCL Smart Patient Reader device, leading to control of the device.
References
Link | Resource |
---|---|
https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01 | Third Party Advisory US Government Resource |
https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
AND |
|
History
21 Nov 2024, 05:20
Type | Values Removed | Values Added |
---|---|---|
References | () https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01 - Third Party Advisory, US Government Resource |
Information
Published : 2020-12-14 20:15
Updated : 2024-11-21 05:20
NVD link : CVE-2020-27252
Mitre link : CVE-2020-27252
CVE.ORG link : CVE-2020-27252
JSON object : View
Products Affected
medtronic
- mycarelink_smart_model_25000_firmware
- mycarelink_smart_model_25000
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition