Medtronic Valleylab FT10 and FX8

Risk Summary

Successful exploitation of these vulnerabilities may allow an attacker to overwrite files or remotely execute code, resulting in a remote, non-root shell on the affected products. By default, the network connections on these devices are disabled. Additionally, the Ethernet port is disabled upon reboot. However, it is known that network connectivity is often enabled.

CVEs (3)

Remediations

• Software patches are currently available for the FT10 platform and will be available in early 2020 for the FX8 platform. Until these updates can be applied, Medtronic recommends to either disconnect affected products from IP networks or to segregate those networks, such that the devices are not accessible from an untrusted network (e.g., Internet). Patches can be downloaded at the following location:
• https://www.medtronic.com/covidien/en-us/support/software.html
• Medtronic has released additional patient focused information, at the following location:
• https://www.medtronic.com/security

Affected Vendors

Affected Products (3)

Affected Sectors

Healthcare and Public Health