Critical · published March 25, 2019
🚨 With adjacent access, an attacker can directly manipulate the memory of implanted cardiac devices. That's a life-altering vulnerability we definitely don't want! 🔥 Think of it like a hospital intercom system that anyone nearby can hijack to change orders or information — without any verification process in place. With the right tools, an intruder could send a false command as easily as someone picking up a phone and dialing in a new order without anyone checking their identity. An attacker could intercept and modify telemetry communication to implanted cardiac devices, potentially altering critical settings. This means they could change medication dosages, adjust device thresholds, or even disable life-saving functions altogether. Such interference could have absolutely devastating consequences for patients relying on these devices for their heart health.
Think of it like a hospital intercom system that anyone nearby can hijack to change orders or information — without any verification process in place. With the right tools, an intruder could send a false command as easily as someone picking up a phone and dialing in a new order without anyone checking their identity. This vulnerability exists because the Conexus telemetry protocol used in various Medtronic devices lacks proper authentication and authorization measures, allowing nearby malicious actors to interact with the devices without any safeguards in place.
An attacker could intercept and modify telemetry communication to implanted cardiac devices, potentially altering critical settings. This means they could change medication dosages, adjust device thresholds, or even disable life-saving functions altogether. Such interference could have absolutely devastating consequences for patients relying on these devices for their heart health. Immediately assess the devices in your environment to identify affected versions (24950, 24952, etc.). Ensure that the devices are configured to minimize exposure, such as keeping radio functionality off when not in use. Stay updated with Medtronic's patches and guidance for securing these devices as they become available. You've got this! Together, we can tackle this vulnerability and protect those who rely on these vital devices. 🛡️