What’s Vulnerable › Vulnerabilities

CVE-2018-18984: Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-12-14 · updated 2026-06-17
• Weakness: CWE-311

Description

Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest .

Affected products

• Medtronic 29901 Encore Programmer Firmware: all versions
• Medtronic Carelink 2090 Programmer Firmware: all versions
• Medtronic Carelink 9790 Programmer Firmware: all versions

References

• http://www.securityfocus.com/bid/106215
• https://global.medtronic.com/xg-en/product-security/security-bulletins/carelink-9790-2090-29901.html
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-347-01
• http://www.securityfocus.com/bid/106215
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-347-01

Get alerted when CVE-2018-18984 or the next vulnerability affects your stack