TI-2023-11180 Aliases CVE-2023-25931 GHSA-crgr-72p3-3g72

Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue

LOW 30CWE-620Published 2023-03-01 · Updated 2025-03-07

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which has greater control over therapy parameters than the patient app. Changes still cannot be made outside of the established therapy parameters of the programmer. For unauthorized access to occur, an individual would need physical access to the Smart Programmer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00266 18th percentileScored 2026-11-07

Fix Fixed InsterStim Applications (Medtronic): A51200, A51300

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Medtronic	InsterStim Applications	Micro Clinician to before A51200; InterStim X Clinician to before A51300	A51200, A51300	Patch available	CNA

InsterStim Applications VendorMedtronic Affected Micro Clinician to before A51200; InterStim X Clinician to before A51300 Fixed in A51200, A51300 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:medtronic:interstim_x_clinician:a51300:::::::*	a51300	Vulnerable	Medtronic
cpe:2.3:a:medtronic:micro_clinician:a51200:::::::*	a51200	Vulnerable	Medtronic

cpe:2.3:a:medtronic:interstim_x_clinician:a51300:*:*:*:*:*:*:* Versions a51300 Vulnerable ·Medtronic
cpe:2.3:a:medtronic:micro_clinician:a51200:*:*:*:*:*:*:* Versions a51200 Vulnerable ·Medtronic

Remediation

Fix · CNA InsterStim Applications (Medtronic) Fixed in A51200, A51300

Timeline

2026-10-02 Threatist record created from CVE-2023-25931
2026-10-03 Alias added: GHSA-crgr-72p3-3g72

References

Advisory 1

https://global.medtronic.com/xg-en/product-security/security-bulletins/pelvic-health-interstim-micro.html

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences