CVE-2020-10627

Description

Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured Personal Diabetes Manager device. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with access to one of the affected insulin pump models may be able to modify and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.

Remediation

Workaround:

  • Insulet recommends patients using the affected products talk to their healthcare provider about the risks of continued use, including the possibility of changing to the latest model with increased cybersecurity protection. Additionally, Insulet recommends all patients take the cybersecurity precautions indicated below. Do not connect to or allow any third-party devices to be connected to or use any software not authorized by Insulet. Maintain tight physical control of the pump and devices connected to the pump. Be attentive to pump notifications, alarms, and alerts. Immediately cancel any unintended boluses (a single dose of insulin administered all at once). Monitor blood glucose levels closely and act as appropriate. Get medical help immediately when experiencing symptoms of severe hypoglycemia or diabetic ketoacidosis or if you suspect insulin pump settings or insulin delivery has changed unexpectedly. Insulet has released additional patient-focused information: https://www.myomnipod.com/security-bulletins More information is available regarding Insulet’s product security and vulnerability management: https://www.myomnipod.com/product-security

Category

7.3
CVSS
Severity: High
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.08%
Vendor Advisory myomnipod.com
Affected: Insulet Omnipod Insulin Management System
Published at:
Updated at:

References

Link Tags
https://us-cert.cisa.gov/ics/advisories/icsma-20-079-01 third party advisory us government resource
https://www.myomnipod.com/security-bulletins vendor advisory

Frequently Asked Questions

What is the severity of CVE-2020-10627?
CVE-2020-10627 has been scored as a high severity vulnerability.
How to fix CVE-2020-10627?
As a workaround for remediating CVE-2020-10627: Insulet recommends patients using the affected products talk to their healthcare provider about the risks of continued use, including the possibility of changing to the latest model with increased cybersecurity protection. Additionally, Insulet recommends all patients take the cybersecurity precautions indicated below. Do not connect to or allow any third-party devices to be connected to or use any software not authorized by Insulet. Maintain tight physical control of the pump and devices connected to the pump. Be attentive to pump notifications, alarms, and alerts. Immediately cancel any unintended boluses (a single dose of insulin administered all at once). Monitor blood glucose levels closely and act as appropriate. Get medical help immediately when experiencing symptoms of severe hypoglycemia or diabetic ketoacidosis or if you suspect insulin pump settings or insulin delivery has changed unexpectedly. Insulet has released additional patient-focused information: https://www.myomnipod.com/security-bulletins More information is available regarding Insulet’s product security and vulnerability management: https://www.myomnipod.com/product-security
Is CVE-2020-10627 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2020-10627 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2020-10627?
CVE-2020-10627 affects Insulet Omnipod Insulin Management System.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.