Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay
Priority LOW 25CWE-294Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-294.
Summary
Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.
Why it matters now
EPSS 0.00712 53rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Medtronic | MMT- 508 - MiniMed pump | All versions | — | No fix listed | CNA |
| Medtronic | MMT – 511 pump Paradigm | All versions | — | No fix listed | CNA |
| Medtronic | MMT – 512 / MMT – 712 Paradigm x12 | All versions | — | No fix listed | CNA |
| Medtronic | MMT – 515 / MMT – 715 Paradigm x15 | All versions | — | No fix listed | CNA |
| Medtronic | MMT – 522 / MMT – 722 Paradigm REAL-TIME | All versions | — | No fix listed | CNA |
| Medtronic | MMT – 522(K) / MMT – 722(K) Paradigm REAL-TIME | All versions | — | No fix listed | CNA |
| Medtronic | MMT – 523 / MMT – 723 Paradigm Revel | All versions | — | No fix listed | CNA |
| Medtronic | MMT – 523(K) / MMT – 723(K) Paradigm | All versions | — | No fix listed | CNA |
| Medtronic | MMT – 554 / MMT – 754 MiniMed Veo | All versions | — | No fix listed | CNA |
| Medtronic | MMT – 551 / MMT – 751 MiniMed 530G | All versions | — | No fix listed | CNA |
- MMT- 508 - MiniMed pump VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- MMT – 511 pump Paradigm VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- MMT – 512 / MMT – 712 Paradigm x12 VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- MMT – 515 / MMT – 715 Paradigm x15 VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- MMT – 522 / MMT – 722 Paradigm REAL-TIME VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- MMT – 522(K) / MMT – 722(K) Paradigm REAL-TIME VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- MMT – 523 / MMT – 723 Paradigm Revel VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- MMT – 523(K) / MMT – 723(K) Paradigm VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- MMT – 554 / MMT – 754 MiniMed Veo VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- MMT – 551 / MMT – 751 MiniMed 530G VendorMedtronic Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:medtronicdiabetes:508_minimed_insulin_pump_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronicdiabetes |
| cpe:2.3:h:medtronicdiabetes:508_minimed_insulin_pump:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronicdiabetes |
| cpe:2.3:o:medtronicdiabetes:522_paradigm_real-time_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronicdiabetes |
| cpe:2.3:h:medtronicdiabetes:522_paradigm_real-time:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronicdiabetes |
| cpe:2.3:o:medtronicdiabetes:722_paradigm_real-time_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronicdiabetes |
| cpe:2.3:h:medtronicdiabetes:722_paradigm_real-time:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronicdiabetes |
| cpe:2.3:o:medtronicdiabetes:523_paradigm_revel_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronicdiabetes |
| cpe:2.3:h:medtronicdiabetes:523_paradigm_revel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronicdiabetes |
| cpe:2.3:o:medtronicdiabetes:723_paradigm_revel_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronicdiabetes |
| cpe:2.3:h:medtronicdiabetes:723_paradigm_revel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronicdiabetes |
- cpe:2.3:o:medtronicdiabetes:508_minimed_insulin_pump_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronicdiabetes
- cpe:2.3:h:medtronicdiabetes:508_minimed_insulin_pump:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronicdiabetes
- cpe:2.3:o:medtronicdiabetes:522_paradigm_real-time_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronicdiabetes
- cpe:2.3:h:medtronicdiabetes:522_paradigm_real-time:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronicdiabetes
- cpe:2.3:o:medtronicdiabetes:722_paradigm_real-time_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronicdiabetes
- cpe:2.3:h:medtronicdiabetes:722_paradigm_real-time:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronicdiabetes
- cpe:2.3:o:medtronicdiabetes:523_paradigm_revel_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronicdiabetes
- cpe:2.3:h:medtronicdiabetes:523_paradigm_revel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronicdiabetes
- cpe:2.3:o:medtronicdiabetes:723_paradigm_revel_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronicdiabetes
- cpe:2.3:h:medtronicdiabetes:723_paradigm_revel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronicdiabetes
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:medtronicdiabetes:523k_paradigm_revel_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronicdiabetes |
| cpe:2.3:h:medtronicdiabetes:523k_paradigm_revel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronicdiabetes |
| cpe:2.3:o:medtronicdiabetes:723k_paradigm_revel_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronicdiabetes |
| cpe:2.3:h:medtronicdiabetes:723k_paradigm_revel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronicdiabetes |
| cpe:2.3:o:medtronicdiabetes:551_minimed_530g_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronicdiabetes |
| cpe:2.3:h:medtronicdiabetes:551_minimed_530g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronicdiabetes |
| cpe:2.3:o:medtronicdiabetes:751_minimed_530g_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronicdiabetes |
| cpe:2.3:h:medtronicdiabetes:751_minimed_530g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronicdiabetes |
- cpe:2.3:o:medtronicdiabetes:523k_paradigm_revel_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronicdiabetes
- cpe:2.3:h:medtronicdiabetes:523k_paradigm_revel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronicdiabetes
- cpe:2.3:o:medtronicdiabetes:723k_paradigm_revel_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronicdiabetes
- cpe:2.3:h:medtronicdiabetes:723k_paradigm_revel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronicdiabetes
- cpe:2.3:o:medtronicdiabetes:551_minimed_530g_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronicdiabetes
- cpe:2.3:h:medtronicdiabetes:551_minimed_530g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronicdiabetes
- cpe:2.3:o:medtronicdiabetes:751_minimed_530g_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronicdiabetes
- cpe:2.3:h:medtronicdiabetes:751_minimed_530g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronicdiabetes
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-14781
- 2026-10-03 Alias added: GHSA-cv4q-4xgp-cr7m
References
More Medtronic vulnerabilities
- TI-2023-14928 Medtronic Paceart MSMQ Deserialization of Untrusted Data CVSS 3.1CRITICAL 9.8
- TI-2020-15429 Medtronic MyCareLink Smart Heap-based Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2020-16578 Medtronic MyCareLink Smart Time-of-check Time-of-use Race Condition CVSS 3.1HIGH 8.8
- TI-2025-11897 Missing brute-force protection in Medtronic CareLink Network CVSS 3.1CRITICAL 9.8
- TI-2019-04592 Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control CVSS 3.1CRITICAL 9.3
- TI-2020-15425 Medtronic MyCareLink Smart Improper Authentication CVSS 3.1HIGH 8.8
Sources
- CVE-2018-14781 · CVE Program
- CVE-2018-14781 · NVD
- FIRST EPSS
- GHSA-cv4q-4xgp-cr7m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences