SB2020032001 - Improper access control in Insulet Omnipod Insulin Management System

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper access control (CVE-ID: CVE-2020-10597)

The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the wireless RF communication protocol. A local attacker with access to one of the affected insulin pump models can bypass implemented security restrictions and modify and/or intercept data.

The vulnerability can also allow attackers to change pump settings and control insulin delivery.

This vulnerability affects the following versions of the Omnipod Insulin Management System:

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://ics-cert.us-cert.gov/advisories/icsma-20-079-01