Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
SIPLUS NET variants) (All versions < V3.3), TIM 4R-IE (incl. SIPLUS NET variants) (All versions < V2.8), TIM 4R-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.3). The affected versions contain an open debug port that is available under certain specific conditions. The vulnerability is only available if the IP address is configured to 192.168.1.2. If available, the debug port could be exploited by an attacker with network access to the device. No user interaction is required to exploit this vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the affected device. At the stage of publishing this security advisory no public exploitation is known. Add
ilability of the affected device. At the stage of publishing this security advisory no public exploitation is known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-359303.pdf
CVE ID: CVE-2019-10940 State: PUBLISHED Published: 2020-01-16T15:35:24 Last Updated: 2024-08-04T22:40:15.429Z Vendors: Siemens AG Products: SINEMA Server Problem Types: CWE-266 Description: A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation could allow an attacker with a valid session, with low privileges, to perform firmware updates and other administrative operations on connected devices. The security vulnerability could be exploited by an attacker with network access to the affected system. An attacker must have access to a low privileged account in order to exploit the vulnerability. An attacker could use the vulnerabili
ust have access to a low privileged account in order to exploit the vulnerability. An attacker could use the vulnerability to compromise confidentiality, integrity, and availability of the affected system and underlying components. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-880233.pdf - https://www.us-cert.gov/ics/advisories/icsa-20-014-02
CVE ID: CVE-2019-10941 State: PUBLISHED Published: 2021-09-14T10:47:02 Last Updated: 2024-08-04T22:40:15.255Z Vendors: Siemens Products: SINEMA Server Problem Types: CWE-306 Description: A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for functionality that requires administrative user identity could allow an attacker to obtain encoded system configuration backup files. This is only possible through network access to the affected system, and successful exploitation requires no system privileges. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-835377.pdf
CVE ID: CVE-2019-10942 State: PUBLISHED Published: 2019-08-13T18:55:57 Last Updated: 2024-08-04T22:40:15.308Z Vendors: Siemens Products: SCALANCE X-200 switch family (incl. SIPLUS NET variants), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants), SCALANCE X204RNA (HSR), SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCALANCE X204RNA EEC (PRP), SCALANCE X204RNA EEC (PRP/HSR) Problem Types: CWE-400 Description: A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X204RNA (HSR) (All versions), SCALANCE X204RNA (PRP) (All
(incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X204RNA (HSR) (All versions), SCALANCE X204RNA (PRP) (All versions), SCALANCE X204RNA EEC (HSR) (All versions), SCALANCE X204RNA EEC (PRP) (All versions), SCALANCE X204RNA EEC (PRP/HSR) (All versions). The device contains a vulnerability that could allow an attacker to trigger a denial-of-service condition by sending large message packages repeatedly to the telnet service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the dev
system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-100232.pdf
CVE ID: CVE-2019-10943 State: PUBLISHED Published: 2019-08-13T18:55:57 Last Updated: 2024-08-04T22:40:15.602Z Vendors: Siemens Products: SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-1500 Software Controller, SIMATIC S7-PLCSIM Advanced Problem Types: CWE-353 Description: A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V20.8), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V20.8), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.4.0), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions >= V4.4.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.8.1), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.8.1), SIMATIC S7-1500 Sof
SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.8.1), SIMATIC S7-1500 Software Controller (All versions < V20.8), SIMATIC S7-1500 Software Controller (All versions >= V20.8), SIMATIC S7-PLCSIM Advanced (All versions < V3.0), SIMATIC S7-PLCSIM Advanced (All versions >= V3.0). An attacker with network access to port 102/tcp could potentially modify the user program on the PLC in a way that the running code is different from the source code which is stored on the device. An attacker must have network access to affected devices and must be able to perform changes to the user program. The vulnerability could impact the perceived integrity of the user
must be able to perform changes to the user program. The vulnerability could impact the perceived integrity of the user program stored on the CPU. An engineer that tries to obtain the code of the user program running on the device, can receive different source code that is not actually running on the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-232418.pdf
CVE ID: CVE-2019-10945 State: PUBLISHED Published: 2019-04-10T18:07:28 Last Updated: 2024-08-04T22:40:15.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/777-20190401-core-directory-traversal-in-com-media - https://www.exploit-db.com/exploits/46710/ - http://packetstormsecurity.com/files/152515/Joomla-3.9.4-Arbitrary-File-Deletion-Directory-Traversal.html
CVE ID: CVE-2019-10946 State: PUBLISHED Published: 2019-04-10T18:08:53 Last Updated: 2024-08-04T22:40:15.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/778-20190402-core-helpsites-refresh-endpoint-callable-for-unauthenticated-users
CVE ID: CVE-2019-10947 State: PUBLISHED Published: 2019-04-17T14:04:53 Last Updated: 2024-08-04T22:40:15.259Z Vendors: n/a Products: Delta Industrial Automation CNCSoft Problem Types: CWE-121 Description: Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. This may occur because CNCSoft lacks user input validation before copying data from project files onto the stack. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01 -
ditional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01 - https://www.zerodayinitiative.com/advisories/ZDI-19-417/ - https://www.zerodayinitiative.com/advisories/ZDI-19-399/ - https://www.zerodayinitiative.com/advisories/ZDI-19-401/ - https://www.zerodayinitiative.com/advisories/ZDI-19-402/ - https://www.zerodayinitiative.com/advisories/ZDI-19-403/ - https://www.zerodayinitiative.com/advisories/ZDI-19-404/ - https://www.zerodayinitiative.com/advisories/ZDI-19-410/ - https://www.zerodayinitiative.com/advisories/ZDI-19-400/ - http://www.securityfocus.com/bid/107989
CVE ID: CVE-2019-10948 State: PUBLISHED Published: 2019-04-30T16:41:37 Last Updated: 2024-08-04T22:40:15.443Z Vendors: Fujifilm Products: Fujifilm FCR Capsula X/ Carbon X Problem Types: CWE-400 Description: Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X are susceptible to a denial-of-service condition as a result of an overflow of TCP packets, which requires the device to be manually rebooted. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSMA-19-113-01
CVE ID: CVE-2019-10949 State: PUBLISHED Published: 2019-04-17T14:03:17 Last Updated: 2024-08-04T22:40:15.240Z Vendors: n/a Products: Delta Industrial Automation CNCSoft Problem Types: CWE-125 Description: Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple out-of-bounds read vulnerabilities may be exploited, allowing information disclosure due to a lack of user input validation for processing specially crafted project files. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01 - https://www.zerodayinitiative.com/advisories/ZDI-19-418/ - https://www.zerodayinitiative.com/advisories/ZDI
-19-106-01 - https://www.zerodayinitiative.com/advisories/ZDI-19-418/ - https://www.zerodayinitiative.com/advisories/ZDI-19-406/ - https://www.zerodayinitiative.com/advisories/ZDI-19-419/ - https://www.zerodayinitiative.com/advisories/ZDI-19-412/ - https://www.zerodayinitiative.com/advisories/ZDI-19-413/ - https://www.zerodayinitiative.com/advisories/ZDI-19-416/ - https://www.zerodayinitiative.com/advisories/ZDI-19-411/ - https://www.zerodayinitiative.com/advisories/ZDI-19-415/ - https://www.zerodayinitiative.com/advisories/ZDI-19-407/ - https://www.zerodayinitiative.com/advisories/ZDI-19-409/ - https://www.zerodayinitiative.com/advisories/ZDI-19-414/ - http://www.securityfocus.com/bid/10798
visories/ZDI-19-409/ - https://www.zerodayinitiative.com/advisories/ZDI-19-414/ - http://www.securityfocus.com/bid/107989
CVE ID: CVE-2019-10950 State: PUBLISHED Published: 2019-04-30T16:44:35 Last Updated: 2024-08-04T22:40:15.366Z Vendors: Fujifilm Products: Fujifilm FCR Capsula X/ Carbon X Problem Types: CWE-284 Description: Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X provide insecure telnet services that lack authentication requirements. An attacker who successfully exploits this vulnerability may be able to access the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSMA-19-113-01 - http://www.securityfocus.com/bid/108052
CVE ID: CVE-2019-10951 State: PUBLISHED Published: 2019-04-17T14:04:03 Last Updated: 2024-08-04T22:40:15.223Z Vendors: n/a Products: Delta Industrial Automation CNCSoft Problem Types: CWE-122 Description: Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. There is a lack of user input validation before copying data from project files onto the heap. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01 - https://www.zerodayi
es: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01 - https://www.zerodayinitiative.com/advisories/ZDI-19-405/ - https://www.zerodayinitiative.com/advisories/ZDI-19-408/ - http://www.securityfocus.com/bid/107989
CVE ID: CVE-2019-10952 State: PUBLISHED Published: 2019-05-01T19:02:42 Last Updated: 2024-08-04T22:40:15.266Z Vendors: Rockwell Automation Products: CompactLogix 5370 L1 controllers, CompactLogix 5370 L2 controllers, CompactLogix 5370 L3 controllers, Compact GuardLogix 5370 controllers, Armor Compact GuardLogix 5370 controllers Problem Types: CWE-400 Description: An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is required for recovering CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix
covering CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01 - http://www.securityfocus.com/bid/108118 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979
CVE ID: CVE-2019-10953 State: PUBLISHED Published: 2019-04-17T14:02:15 Last Updated: 2024-08-04T22:40:15.294Z Vendors: n/a Products: ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers Problem Types: CWE-400 Description: ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-106-03 - http://www.securityfocus.com/bid/108413
CVE ID: CVE-2019-10954 State: PUBLISHED Published: 2019-05-01T18:59:28 Last Updated: 2024-08-04T22:40:15.332Z Vendors: Rockwell Automation Products: CompactLogix 5370 L1 controllers, CompactLogix 5370 L2 controllers, CompactLogix 5370 L3 controllers, Compact GuardLogix 5370 controllers, Armor Compact GuardLogix 5370 controllers Problem Types: CWE-121 Description: An attacker could send crafted SMTP packets to cause a denial-of-service condition where the controller enters a major non-recoverable faulted state (MNRF) in CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier. Additional Analy
uardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01 - http://www.securityfocus.com/bid/108118 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979
CVE ID: CVE-2019-10955 State: PUBLISHED Published: 2019-04-25T17:27:32 Last Updated: 2024-08-04T22:40:15.190Z Vendors: Rockwell Automation Products: MicroLogix 1400 Controllers, MicroLogix 1100 Controllers, CompactLogix 5370 L1 controllers, CompactLogix 5370 L2 controllers, CompactLogix 5370 L3 controllers Problem Types: CWE-601 Description: In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 and earlier, CompactLogix 5370 L1 controllers v30.014 and earlier, CompactLogix 5370 L2 controllers v30.014 and earlier, CompactLogix 5370 L3 controllers (includes CompactLogix GuardLogix controllers) v30.014 and ear
ers v30.014 and earlier, CompactLogix 5370 L3 controllers (includes CompactLogix GuardLogix controllers) v30.014 and earlier, an open redirect vulnerability could allow a remote unauthenticated attacker to input a malicious link to redirect users to a malicious site that could run or download arbitrary malware on the user’s machine. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-113-01 - https://www.securityfocus.com/bid/108049
CVE ID: CVE-2019-10956 State: PUBLISHED Published: 2020-01-17T17:52:38 Last Updated: 2024-08-04T22:40:15.637Z Vendors: n/a Products: Geutebruck IP Cameras Problem Types: CWE-78 Description: Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated user, using a specially crafted URL command, to execute commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/ICSA-19-155-03
CVE ID: CVE-2019-10957 State: PUBLISHED Published: 2020-01-17T17:53:09 Last Updated: 2024-08-04T22:40:15.636Z Vendors: n/a Products: Geutebruck IP Cameras Problem Types: CWE-79 Description: Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacker with access to event configuration to store malicious code on the server, which could later be triggered by a legitimate user resulting in code execution within the user’s browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/ICSA-19-155-03
CVE ID: CVE-2019-10958 State: PUBLISHED Published: 2020-01-17T17:53:34 Last Updated: 2024-08-04T22:40:15.615Z Vendors: n/a Products: Geutebruck IP Cameras Problem Types: CWE-78 Description: Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacker with access to network configuration to supply system commands to the server, leading to remote code execution as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/ICSA-19-155-03
CVE ID: CVE-2019-10959 State: PUBLISHED Published: 2019-06-13T20:03:44 Last Updated: 2024-08-04T22:40:15.550Z Vendors: n/a Products: BD Alaris Gateway Workstation Problem Types: CWE-434 Description: BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC, Alaris TIVA, The application does not restrict the upload of malicious files during a firmware update. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/adviso
a firmware update. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01 - http://www.securityfocus.com/bid/108765
CVE ID: CVE-2019-10960 State: PUBLISHED Published: 2019-08-20T20:53:23 Last Updated: 2024-08-04T22:40:15.449Z Vendors: n/a Products: Zebra Industrial Printers All Versions Problem Types: CWE-522 Description: Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option to use a passcode to limit the functionality of the front panel is applied, specially crafted packets could be sent over the same network to a port on the printer and the printer will respond with an array of information that includes the front panel passcode for the printer. Once the passcode is retrieved, an attacker must have physical access to the
s the front panel passcode for the printer. Once the passcode is retrieved, an attacker must have physical access to the front panel of the printer to enter the passcode to access the full functionality of the front panel. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-19-232-01
CVE ID: CVE-2019-10961 State: PUBLISHED Published: 2019-08-02T16:06:09 Last Updated: 2024-08-04T22:40:15.551Z Vendors: n/a Products: Advantech WebAccess HMI Designer Problem Types: CWE-787 Description: In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area, allowing remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-19-213-01 - https://www.zerodayinitiative.com/advisories/ZDI-19-691/
CVE ID: CVE-2019-10962 State: PUBLISHED Published: 2019-06-13T20:03:37 Last Updated: 2024-08-04T22:40:15.685Z Vendors: n/a Products: BD Alaris Gateway Workstation Problem Types: CWE-284 Description: BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not prevent an attacker with knowledge of the IP address of the Alaris Gateway Workstation terminal to gain access to the status and configuration information of the device. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01 - http://www.securityfocus.com/bid/108763
CVE ID: CVE-2019-10963 State: PUBLISHED Published: 2019-10-08T18:41:43 Last Updated: 2024-08-04T22:40:15.565Z Vendors: n/a Products: Moxa EDR 810 Problem Types: CWE-321 Description: Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive information disclosure. Log files must have previously been exported by a legitimate user. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-19-274-03 - http://packetstormsecurity.com/files/154943/Moxa-EDR-810-Command-Injection-Information-Disclosure.html
CVE ID: CVE-2019-10964 State: PUBLISHED Published: 2019-06-28T20:58:07 Last Updated: 2025-05-22T18:29:15.376Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Medtronic Products: MiniMed 508 pump, MiniMed Paradigm 511 pump, MiniMed Paradigm 512/712 pumps, MiniMed Paradigm 712E pump, MiniMed Paradigm 515/715 pumps, MiniMed Paradigm 522/722 pumps, MiniMed Paradigm 522K/722K pumps, MiniMed Paradigm 523/723 pumps, MiniMed Paradigm 523K/723K pumps, MiniMed Paradigm Veo 554/754 pumps, MiniMed Paradigm Veo 554CM/754CM pumps Problem Types: CWE-284 Description: Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as bl
cription: Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery. Additional Analyst Notes: - CVE Program Container: References: - https://global.medtronic.com/xg-en/product-security/security-bulletins/minimed-508-paradigm.html - https://www.c