CVE-2018-8870

Medtronic MyCareLink Patient Monitor Use of Hard-coded Password

State: Published
Severity: 6.4 Medium
Published: Jul 2, 2018
Updated: May 22, 2025
Reserved: Mar 20, 2018

Description

Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove the case of the device, connect to the debug port, and use the password to gain privileged access to the operating system.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-259

Affected Products

Product	Versions
24950 MyCareLink MonitorMedtronic	All versionsAffected
24952 MyCareLink MonitorMedtronic	All versionsAffected

References

https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-6-28-18.html
https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.