Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an In…

published 2021-12-01 4 y ago modified 2026-06-17 4 mo ago also EUVD-2020-3075

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured Personal Diabetes Manager device. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with access to one of the affected insulin pump models may be able to modify and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-20-079-01 updated 2020-03-19 cvss 7.3

Insulet Omnipod

Insulet Omnipod Insulin Management System UDI/Model/NDC number ZXP425 (10-Pack), ZXR425 (10-Pack Canada), Product ID/Reorder number 19191, 40160
affected: vendor fix myomnipod.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
NVD	3.1	8.1	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD	2.0	4.8	AV:A/AC:L/Au:N/C:P/I:P/A:N

Affected products

Insulet Omnipod Insulin Management System

Classification

Weakness

CWE-284 Improper Access Control

References

myomnipod.com /security-bulletins
vendor-advisory
us-cert.cisa.gov /ics/advisories/icsma-20-079-01
third-party-advisory, us-government-resource

Sources

CVE List CVE-2020-10627
NVD CVE-2020-10627

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary