CVE-2017-5149 An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 (RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability). The...
HighCVSS 8.9
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 (RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability). The identities of the endpoints for the communication channel between the transmitter and St. Jude Medical's web site, Merlin.net, are not verified. This may allow a man-in-the-middle attacker to access or influence communications between the identified endpoints.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| abbott merlinhome firmware | <= 8.0 | No fix listed |
References
- 95331 third-party-advisory vdb-entry
- ics-cert.us-cert.gov mitigation third-party-advisory us-government-resource