CVE-2018-10596 describes a critical vulnerability in the Medtronic 2090 CareLink Programmer, where the device fails to verify its VPN connection before downloading updates, affecting both the programmer and its firmware. This flaw allows an attacker with network access to the programmer to terminate the VPN, intercept update requests, and deliver malicious updates via a Man-in-the-Middle attack, as the device does not validate the origin or integrity of these updates. The vulnerability carries a CVSS score of 8.0 (High), indicating a significant risk due to its adjacent network attack vector (AV:A), low attack complexity (AC:L), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). An attacker with low privileges (PR:L) can exploit this without user interaction (UI:N). Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:medtronic:2090_carelink_programmer_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.