CVE-2020-27252CWE-367

Medtronic MyCareLink Smart Time-of-check Time-of-use Race Condition

High · published December 14, 2020

CVSS v3.1
8.8
EPSS
4%
Percentile
90.1
In the wild
Unconfirmed
What it is

Medtronic MyCareLink Smart 25000 is

vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited, an attacker could remotely execute code on the MCL Smart Patient Reader device, leading to control of the device.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03840 · 90.1th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2020-12-14T19:19Z
EPSS history
Timeline
  • 14 DEC 19:19Z
    Medtronic MyCareLink Smart Time-of-check Time-of-use Race Condition
    cvelistv5