Medtronic MyCareLink Patient Monitor Cleartext Credential Storage Vulnerability

A vulnerability exists in the Medtronic MyCareLink Patient Monitor models 24950 and 24952, all versions, due to the use of per-product credentials stored in a recoverable format. This flaw allows an attacker with physical access to the device to extract these credentials, which are used to authenticate data uploads and encrypt data at rest. Exploitation of this vulnerability could lead to unauthorized manipulation of encrypted drive data and the upload of invalid information to the Medtronic CareLink network.

Impact

Exploitation of this vulnerability could result in unauthorized access to per-product credentials, allowing for manipulation of encrypted drive data and the upload of invalid information to the Medtronic CareLink network.

Remediation

Medtronic has begun deploying security updates to address these vulnerabilities. The update process is automatic when the monitor is connected to the internet. Patients should ensure their monitor is plugged in to receive updates. For more information, contact Medtronic CareLink Patient Services at 800-929-4043.