Vulnerability-Lookup

CNVD-2018-10004

Vulnerability from cnvd - Published: 2018-05-22

Title

Medtronic N'Vision Clinician Programmer信息泄露漏洞

Description

Medtronic N'Vision临床医师程序员是一种小型便携式设备，为美敦力神经移植治疗设备提供单一编程平台。 Medtronic N'Vision Clinician Programmer存在信息泄露漏洞，攻击者可利用漏洞获得敏感信息。

Severity

中

Formal description

目前没有详细的解决方案提供： https://www.medtronic.com/security

Reference

https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01

Impacted products

Name
["Medtronic 8870 N'Vision Application Card", "Medtronic 8840 N'Vision Clinician Programmer"]

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "104213"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-8849"
    }
  },
  "description": "Medtronic  N\u0027Vision\u4e34\u5e8a\u533b\u5e08\u7a0b\u5e8f\u5458\u662f\u4e00\u79cd\u5c0f\u578b\u4fbf\u643a\u5f0f\u8bbe\u5907\uff0c\u4e3a\u7f8e\u6566\u529b\u795e\u7ecf\u79fb\u690d\u6cbb\u7597\u8bbe\u5907\u63d0\u4f9b\u5355\u4e00\u7f16\u7a0b\u5e73\u53f0\u3002\r\n\r\nMedtronic N\u0027Vision Clinician Programmer\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u83b7\u5f97\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "Billy Rios of Whitescope LLC",
  "formalWay": "\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u89e3\u51b3\u65b9\u6848\u63d0\u4f9b\uff1a\r\nhttps://www.medtronic.com/security",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-10004",
  "openTime": "2018-05-22",
  "products": {
    "product": [
      "Medtronic 8870 N\u0027Vision Application Card",
      "Medtronic 8840 N\u0027Vision Clinician Programmer"
    ]
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01",
  "serverity": "\u4e2d",
  "submitTime": "2018-05-21",
  "title": "Medtronic N\u0027Vision Clinician Programmer\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2018-8849 (GCVE-0-2018-8849)

Vulnerability from cvelistv5 – Published: 2018-05-18 13:00 – Updated: 2025-06-27 16:24

Title

Medtronic N'Vision Clinician Programmer Missing Encryption of Sensitive Data

Summary

Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest.

Severity

4.6 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-311 - MISSING ENCRYPTION OF SENSITIVE DATA CWE-311

Assigner

icscert icscert root

References

5 references

URL	Tags
http://www.securityfocus.com/bid/104213	vdb-entryx_refsource_BID
https://www.cisa.gov/news-events/ics-medical-advi…	x_refsource_MISC
http://www.medtronic.com/content/dam/medtronic-co…	x_refsource_CONFIRM
https://www.medtronic.com/security
https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01	x_refsource_MISCx_transferred

Impacted products

2 products

Vendor	Product	Version
Medtronic	N'Vision Clinician Programmer	Affected: all versions
Medtronic	8870 N’Vision removable Application Card	Affected: all versions

Date Public

2018-05-17 06:00

Credits

Billy Rios and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:10:45.899Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "104213",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104213"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/Medtronic-NVision-8840_Security-Bulletin_FINAL.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "N\u0027Vision Clinician Programmer",
          "vendor": "Medtronic",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "8870 N\u2019Vision removable Application Card",
          "vendor": "Medtronic",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Billy Rios and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA."
        }
      ],
      "datePublic": "2018-05-17T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMedtronic N\u0027Vision Clinician Programmer 8840 N\u0027Vision Clinician Programme and 8870 N\u0027Vision removable Application Card do not encrypt PII and PHI while at rest.\u003c/p\u003e"
            }
          ],
          "value": "Medtronic N\u0027Vision Clinician Programmer 8840 N\u0027Vision Clinician Programme and 8870 N\u0027Vision removable Application Card do not encrypt PII and PHI while at rest."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-311",
              "description": "MISSING ENCRYPTION OF SENSITIVE DATA CWE-311",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-27T16:24:54.910Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "104213",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104213"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-137-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/Medtronic-NVision-8840_Security-Bulletin_FINAL.pdf"
        },
        {
          "url": "https://www.medtronic.com/security"
        }
      ],
      "source": {
        "advisory": "ICSMA-18-137-01",
        "discovery": "EXTERNAL"
      },
      "title": "Medtronic N\u0027Vision Clinician Programmer Missing Encryption of Sensitive Data",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMedtronic has not developed a product update to address the \nvulnerabilities, but is reinforcing security reminders within this \nadvisory to help reduce the risk associated with the vulnerabilities.\u003c/p\u003e\n\u003cp\u003eThe 8870 Therapy Application card stores PHI and PII as part of its \nnormal operating procedure and should be handled, managed and secured in\n a manner consistent with the applicable laws for patient data privacy.\u003c/p\u003e\n\u003cp\u003eMedtronic recommends users take additional defensive measures to \nminimize the risk of exploitation of these vulnerabilities. \nSpecifically, hospitals and clinicians should:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMaintain strict physical control of the 8870 application card.\u003c/li\u003e\n\u003cli\u003eUse only legitimately obtained 8870 cards and not cards provided by \nany third party as firmware and system updates are provided directly by \nMedtronic using new 8870 application cards.\u003c/li\u003e\n\u003cli\u003e8840 Programmers and 8870 Therapy Application compact flash cards \nare the property of Medtronic and should be returned to Medtronic when \nno longer in use. If that is not an option, you should securely dispose \nof them.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eMedtronic has released additional patient focused information, at the following location:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.medtronic.com/security\"\u003ehttps://www.medtronic.com/security\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Medtronic has not developed a product update to address the \nvulnerabilities, but is reinforcing security reminders within this \nadvisory to help reduce the risk associated with the vulnerabilities.\n\n\nThe 8870 Therapy Application card stores PHI and PII as part of its \nnormal operating procedure and should be handled, managed and secured in\n a manner consistent with the applicable laws for patient data privacy.\n\n\nMedtronic recommends users take additional defensive measures to \nminimize the risk of exploitation of these vulnerabilities. \nSpecifically, hospitals and clinicians should:\n\n\n\n  *  Maintain strict physical control of the 8870 application card.\n\n  *  Use only legitimately obtained 8870 cards and not cards provided by \nany third party as firmware and system updates are provided directly by \nMedtronic using new 8870 application cards.\n\n  *  8840 Programmers and 8870 Therapy Application compact flash cards \nare the property of Medtronic and should be returned to Medtronic when \nno longer in use. If that is not an option, you should securely dispose \nof them.\n\n\n\n\nMedtronic has released additional patient focused information, at the following location:\n\n\n https://www.medtronic.com/security"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2018-05-17T00:00:00",
          "ID": "CVE-2018-8849",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "N\u0027Vision Clinician Programmer",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "8840 N\u0027Vision Clinician Programmer, all versions"
                          },
                          {
                            "version_value": "8870 N\u0027Vision removable Application Card, all versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Medtronic"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Medtronic N\u0027Vision Clinician Programmer 8840 N\u0027Vision Clinician Programmer, all versions, and 8870 N\u0027Vision removable Application Card, all versions does not encrypt PII and PHI while at rest."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "MISSING ENCRYPTION OF SENSITIVE DATA CWE-311"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "104213",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104213"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01"
            },
            {
              "name": "http://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/Medtronic-NVision-8840_Security-Bulletin_FINAL.pdf",
              "refsource": "CONFIRM",
              "url": "http://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/Medtronic-NVision-8840_Security-Bulletin_FINAL.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-8849",
    "datePublished": "2018-05-18T13:00:00.000Z",
    "dateReserved": "2018-03-20T00:00:00.000Z",
    "dateUpdated": "2025-06-27T16:24:54.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2018-10004

CVE-2018-8849 (GCVE-0-2018-8849)

Tags

Sightings

Nomenclature

Related by attack behaviour