The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has issued an advisory about a vulnerability that has been identified in certain Medtronic CareLink and Encore Programmers.
ICS-CERT, an organisation created to identify and tackle problems in cybersecurity infrastructure, announced that the flaw was discovered earlier this month. Security researchers determined that some personally identifiable information (PII) and protected health information (PHI) stored on the devices could potentially be accessed by unauthorised individuals due to a lack of encryption for data at rest.
The Medtronic CareLink and Encore Programmers are used in hospitals and healthcare facilities to program and manage Medtronic cardiac devices. As a result of their functionality, the devices may store reports containing patients’ PII/PHI.
The result could only be exploited if an attacker had physical access to one of the devices. Should they be able to do so, they could access reports and view patients PII/PHI. Experts determined that vulnerability would require a low level of technical skill to exploit.
The vulnerability, tracked as CVE-2018-18984 (CWE-311), was identified by security researchers Billy Rios and Jonathan Butts of Whitescope LLC who discovered encryption was either missing or stored PII/PHI was not sufficiently encrypted. The vulnerability has been assigned a CVSS V3 base score of 4.6.
The vulnerability is present in all versions of CareLink 2090 Programmers, CareLink 9790 Programmers, and the 29901 Encore Programmers.
In an official statement, Medtronic has advised all hospitals to stop using CareLink 9790 Programmers for any purpose as they have reached end-of-life and are no longer supported. Medtronic is the world’s largest medical device company, with a revenue of nearly $30 billion per annum.
Users of CareLink 2090 and 29901 Encore Programmers should ensure that PII/PHI is stored on the Programmers for the shortest possible time. The devices are only intended to be used to store PII/PHI for short periods of time until the information can be transferred to other medical systems or printed to paper reports.
All affected programmers allow reports containing PII/PHI to be manually deleted when they are no longer required. Users of all vulnerable Programmers should ensure that all PII/PHI is deleted from the devices before they are decommissioned.
Medtronic has also advised users to ensure physical control of the Programmers is maintained at all times to prevent unauthorized access and only to use legitimately obtained Programmers and not to use any that are supplied by a third party.