CVE-2017-12714

moderate-risk

Published 2018-04-25

Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017 do not restrict or limit the number of correctly formatted "RF wake-up" commands that can be received, which may allow a nearby attacker to repeatedly send commands to reduce pacemaker battery life. CVSS v3 base score: 5.3, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.

Do I need to act?

0.21% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

ADJACENT_NETWORK / LOW complexity

Affected Products (7)

Accent Firmware

Anthem Firmware

Accent Mri Firmware

Accent St Firmware

Assurity Firmware

Allure Firmware

Assurity Mri Firmware

Affected Vendors

Abbott

References (4)

Third Party Advisory http://www.securityfocus.com/bid/100523

Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01

Third Party Advisory http://www.securityfocus.com/bid/100523

Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 1/34 · Minimal

Exposure 14/34 · Moderate