Skip to content
Fencer Vulns
medium 5.3

CVE-2018-14781 json

Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay

published 2018-08-13 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-6665

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

Medtronic MiniMed MMT

devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-18-219-02 updated cvss 5.3

Medtronic MiniMed MMT-500/MMT-503 Remote Controllers (Update A)

  • Medtronic MMT-500 Remote Controller MMT-508 MiniMed pump Medtronic MMT-503 Remote Controller MMT-512 / MMT-712 Paradigm x12, MMT-523 / MMT-723 Paradigm Revel, MMT-523(K) / MMT-723(K) Paradigm, MMT-515 / MMT-715 Paradigm x15
    affected: vendor fix medtronic.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.0 5.3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 2.9 AV:A/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • Medtronic MMT- 508 - MiniMed pump
  • Medtronic MMT – 511 pump Paradigm
  • Medtronic MMT – 512 / MMT – 712 Paradigm x12
  • Medtronic MMT – 515 / MMT – 715 Paradigm x15
  • Medtronic MMT – 522 / MMT – 722 Paradigm REAL-TIME
  • Medtronic MMT – 522(K) / MMT – 722(K) Paradigm REAL-TIME
  • Medtronic MMT – 523 / MMT – 723 Paradigm Revel
  • Medtronic MMT – 523(K) / MMT – 723(K) Paradigm
  • Medtronic MMT – 554 / MMT – 754 MiniMed Veo
  • Medtronic MMT – 551 / MMT – 751 MiniMed 530G

Classification

Weakness
  • CWE-294 Authentication Bypass by Capture-replay
  • CWE-287 Improper Authentication

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.