CVE-2018-10626 json
Medtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity
published 2018-08-10 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-2698
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLink network.
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSMA-18-219-01 updated cvss 4.4
Medtronic MyCareLink 24950 Patient Monitor (Update A)
-
Medtronic 24950 MyCareLink Monitor Medtronic 24952 MyCareLink Monitoraffected: mitigation “Medtronic recommends users take additional defensive measures to minimize the risk of exploitation. Specifically, users should:” medtronic.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N |
| NVD | 3.0 | 4.4 | CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.8 | AV:A/AC:M/Au:S/C:P/I:P/A:N |
Affected products
- Medtronic 24950 MyCareLink Monitor
- Medtronic 24952 MyCareLink Monitor
Classification
- Weakness
-
- CWE-345 Insufficient Verification of Data Authenticity
References
- global.medtronic.com /xg-en/product-security/security-bulletins/mycarelink-8-7-18.html
-
securityfocus.com
/bid/105042
vdb-entry, third-party-advisory
- cisa.gov /news-events/ics-medical-advisories/icsma-18-219-01
- github.com /cisagov/CSAF/blob/develop/csaf_files/OT/white/2018/icsma-18-219-01.json
-
ics-cert.us-cert.gov
/advisories/ICSMA-18-219-01
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2018-10626
- NVD CVE-2018-10626
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.