CVE-2020-27252

Solution:

• A firmware update to eliminates these vulnerabilities has been developed by Medtronic and is available by updating the MyCareLink Smartapp via the associated mobile application store. Upgrading to the latest v5.2 mobile application version will ensure the Patient Reader is also updated on next use. The user’s smart phone must be updated to the following operating system version for the patches to be applied: iOS 10 and above; Android 6.0 and above. Medtronic has released additional patient focused information https://www.medtronic.com/security : https://www.medtronic.com/xg-en/product-security/security-bulletins.html https://www.medtronic.com/xg-en/product-security/security-bulletins.html

Workaround:

• In response to these vulnerabilities, Medtronic has applied additional controls for monitoring and responding to improper use of the MCL Smart Patient Reader: * Medtronic has implemented enhanced integrity validation (EIV) technology, which provides early detection and real-time mitigation of known vulnerability exploitation attempts. * Medtronic has also implemented advanced detection system technology, which enables device-level logging and monitoring of all device activity and behavior. Medtronic recommends that users take additional defensive measures to minimize risk. Specifically, users should: * Maintain good physical control over home monitors. * This includes only using home monitors in private environments such as a home, apartment, or otherwise physically controlled environment. * Use only home monitors obtained directly from your healthcare provider or a Medtronic representative. * Patients should ensure that the operating system of their mobile phone is updated to the latest version of the available Android or Apple iOS operating system. Report any concerning behavior regarding these products to your healthcare provider or a Medtronic representative.