CVE-2019-10964 [High] | Security Vulnerability in Minimed 508 Firmware

Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.40%	1.16%	+0.77%
2	2026-05-14	0.34%	0.40%	+0.06%
3	2025-11-21	—	0.34%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.40%

1.16%

+0.77%

2026-05-14

0.34%

0.40%

+0.06%

2025-11-21

—

0.34%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.1	3.1	HIGH	`CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H` Click to expand Attack vector (AV:A) Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.6	5.5	[email protected]
8.8	3.0	HIGH	`CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:A) Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	2.8	5.9	[email protected]
5.8	2.0	MEDIUM	`AV:A/AC:L/Au:N/C:P/I:P/A:P` Click to expand Access vector (AV:A) Requires access to an adjacent network segment. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	6.5	6.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.1

3.1

HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H Click to expand

Attack vector (AV:A): Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.6

5.5

[email protected]

8.8

3.0

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:A): Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

2.8

5.9

[email protected]

5.8

2.0

MEDIUM

AV:A/AC:L/Au:N/C:P/I:P/A:P Click to expand

Access vector (AV:A): Requires access to an adjacent network segment.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

6.5

6.4

[email protected]

Weakness enumeration for CVE-2019-10964

Affected software / configurations for CVE-2019-10964

Vendor	Product	Version	Raw CPE
medtronic	minimed_508_firmware	—	cpe:2.3:o:medtronic:minimed_508_firmware::::::::
medtronic	minimed_paradigm_511_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_511_firmware::::::::
medtronic	minimed_paradigm_512_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_512_firmware::::::::
medtronic	minimed_paradigm_712_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_712_firmware::::::::
medtronic	minimed_paradigm_712e_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_712e_firmware::::::::
medtronic	minimed_paradigm_515_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_515_firmware::::::::
medtronic	minimed_paradigm_715_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_715_firmware::::::::
medtronic	minimed_paradigm_522_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_522_firmware::::::::
medtronic	minimed_paradigm_722_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_722_firmware::::::::
medtronic	minimed_paradigm_522k_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_522k_firmware::::::::
medtronic	minimed_paradigm_722k_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_722k_firmware::::::::
medtronic	minimed_paradigm_523_firmware	<= 2.4a	cpe:2.3:o:medtronic:minimed_paradigm_523_firmware::::::::
medtronic	minimed_paradigm_723_firmware	<= 2.4a	cpe:2.3:o:medtronic:minimed_paradigm_723_firmware::::::::
medtronic	minimed_paradigm_523k_firmware	<= 2.4a	cpe:2.3:o:medtronic:minimed_paradigm_523k_firmware::::::::
medtronic	minimed_paradigm_723k_firmware	<= 2.4a	cpe:2.3:o:medtronic:minimed_paradigm_723k_firmware::::::::
medtronic	minimed_paradigm_veo_554_firmware	<= 2.6a	cpe:2.3:o:medtronic:minimed_paradigm_veo_554_firmware::::::::
medtronic	minimed_paradigm_veo_754_firmware	<= 2.6a	cpe:2.3:o:medtronic:minimed_paradigm_veo_754_firmware::::::::
medtronic	minimed_paradigm_veo_554cm_firmware	<= 2.7a	cpe:2.3:o:medtronic:minimed_paradigm_veo_554cm_firmware::::::::
medtronic	minimed_paradigm_veo_754cm_firmware	—	cpe:2.3:o:medtronic:minimed_paradigm_veo_754cm_firmware:-:::::::*

References for CVE-2019-10964

URL	Tags
http://www.securityfocus.com/bid/108926	Third Party Advisory VDB Entry
https://global.medtronic.com/xg-en/product-security/security-bulletins/minimed-508-paradigm.html
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-178-01
https://www.us-cert.gov/ics/advisories/icsma-19-178-01	Third Party Advisory US Government Resource

URL

CVE-2019-10964 | Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control

Exploit prediction scoring system (EPSS) score for CVE-2019-10964

Common vulnerability scoring system (CVSS) metrics for CVE-2019-10964

Weakness enumeration for CVE-2019-10964

Affected software / configurations for CVE-2019-10964

References for CVE-2019-10964