CVE Vulnerability

CVE-2018-8849

Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programmer, all versions, and 8870 N'Vision removable Application Card, all versions does not encrypt PII and PHI while at rest.

2.1 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

4.6 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://ics-cert.us-cert.gov/advisories/ICSMA-18-137-01 Third Party Advisory US Government Resource
http://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/Medtronic-NVision-8840_Security-Bulletin_FINAL.pdf Vendor Advisory
http://www.securityfocus.com/bid/104213 Third Party Advisory VDB Entry
Configurations

Configuration 1
Information

Published : 2018-05-18 01:29

Updated : 2019-10-09 11:42

NVD link : CVE-2018-8849

Mitre link : CVE-2018-8849

Products Affected
No products.
CWE
CWE-311

Missing Encryption of Sensitive Data