CVE-2018-14781
Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 13, 2018
- Updated
- May 22, 2025
- Reserved
- Aug 1, 2018
Description
Medtronic MiniMed MMT
devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | icscert |
Weaknesses
- CWE-294 Authentication Bypass by Capture-replay
Affected Products
| Product | Versions |
|---|---|
MMT- 508 - MiniMed pumpMedtronic |
|
MMT – 511 pump ParadigmMedtronic |
|
MMT – 512 / MMT – 712 Paradigm x12Medtronic |
|
MMT – 515 / MMT – 715 Paradigm x15Medtronic |
|
MMT – 522 / MMT – 722 Paradigm REAL-TIMEMedtronic |
|
MMT – 522(K) / MMT – 722(K) Paradigm REAL-TIMEMedtronic |
|
MMT – 523 / MMT – 723 Paradigm RevelMedtronic |
|
MMT – 523(K) / MMT – 723(K) ParadigmMedtronic |
|
MMT – 554 / MMT – 754 MiniMed VeoMedtronic |
|
MMT – 551 / MMT – 751 MiniMed 530GMedtronic |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.