CVE-2017-12716

Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programmers and home monitoring units. Additionally, the Accent and Anthem pacemakers store the optional patient information without encryption. CVSS v3 base score: 3.1, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.

CVSS v3 6.5 MEDIUM
CVSS v2.0 3.3 LOW

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

3.3^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 6.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/100523	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:abbott:accent_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abbott:accent:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:abbott:anthem_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abbott:anthem:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:abbott:accent_mri_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abbott:accent_mri:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:abbott:accent_st_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abbott:accent_st:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-04-25 13:29

Updated : 2019-10-09 23:23

NVD link : CVE-2017-12716

Mitre link : CVE-2017-12716

CVE.ORG link : CVE-2017-12716

JSON object : View

Products Affected

abbott

anthem_firmware
accent_mri_firmware
accent_st
accent_mri
accent_firmware
accent
anthem
accent_st_firmware

CWE

CWE-319

Cleartext Transmission of Sensitive Information

CWE-311

Missing Encryption of Sensitive Data

{"id": "CVE-2017-12716", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2018-04-25T13:29:00.333", "references": [{"url": "http://www.securityfocus.com/bid/100523", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-311"}]}], "descriptions": [{"lang": "en", "value": "Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programmers and home monitoring units. Additionally, the Accent and Anthem pacemakers store the optional patient information without encryption. CVSS v3 base score: 3.1, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott has developed a firmware update to help mitigate the identified vulnerabilities."}, {"lang": "es", "value": "Los marcapasos Accent y Anthem de Abbott Laboratories fabricados antes del 28 de agosto de 2017 transmiten informaci\u00f3n no cifrada del paciente mediante comunicaciones de radiofrecuencia y unidades de monitorizaci\u00f3n dom\u00e9stica. Adem\u00e1s, los marcapasos Accent y Anthem almacenan la informaci\u00f3n opcional del paciente sin cifrar. Puntuaci\u00f3n base de CVSS v3: 3.1, cadena de vector CVSS: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott ha desarrollado una actualizaci\u00f3n de firmware para ayudar a mitigar las vulnerabilidades identificadas."}], "lastModified": "2019-10-09T23:23:11.687", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abbott:accent_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFF25F4E-CF32-41A5-9AEC-5CF2A1D70732", "versionEndExcluding": "f0b.0e.7e"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abbott:accent:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7261AA88-1BD6-4CDF-AFC0-31FD7F52B9E7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abbott:anthem_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6C940D7-5EA3-4D42-8FFE-0C38D2D0065E", "versionEndExcluding": "f0b.0e.7e"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abbott:anthem:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4B28402F-D4DF-448B-8ED3-676E0B438331"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abbott:accent_mri_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFC7CD6D-57F8-4479-A25C-9B9937FD3793", "versionEndExcluding": "f10.08.6c"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abbott:accent_mri:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C752B8AA-8990-43DE-AB8B-57329E1E0AE1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abbott:accent_st_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CCA1805-9253-4267-ACE9-B9F3BBB1549A", "versionEndExcluding": "f10.08.6c"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abbott:accent_st:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "794620AF-C8D5-4511-B4AF-5E8B4347F558"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}