Medtronic MiniMed Insulin Pump Remote Bolting Vulnerability Advisory

Key Information Vulnerability Overview Discovery Date: August 7, 2018, updated on March 13, 2019, and October 5, 2021. Vulnerability Description: External security researchers discovered a vulnerability in Medtronic’s MiniMed Paradigm™ insulin pump remote controller. When in use, the Paradigm™ remote (key fob-like device) allows diabetic patients to send remote insulin doses (referred to as “remote bolus”) without physically accessing the insulin pump. This enables users to administer insulin doses from several feet away from the pump. Affected Products MMT-500 Remote Controller - MMT-508 - MiniMed pump (no longer manufactured by Medtronic) MMT-503 Remote Controller - MMT-511 / MMT-712 Paradigm™ x12 - MMT-512 / MMT-714 Paradigm™ 715 - MMT-522 / MMT-722 Paradigm™ REAL-TIME - MMT-522(K) / MMT-722(K) Paradigm™ REAL-TIME - MMT-523 / MMT-723 Paradigm™ Revel - MMT-523(K) / MMT-723(K) Paradigm™ - MMT-554 / MMT-754 MiniMed™ Veo - MMT-551 / MMT-751 MiniMed™ 530G Mitigation Measures Users should immediately stop using and disconnect the remote controller, disable the remote function, and return the remote controller to Medtronic. Multiple conditions must be met to exploit this vulnerability: 1. The pump’s remote option must be enabled. 2. The user’s remote controller ID must be registered to the pump. 3. The easy bolus option must be enabled on the pump and set to an easy bolus size. 4. An unauthorized individual must be in proximity to the user and have the capability to replicate wireless signals. 5. The unauthorized individual must play an RF signal near the user to transmit a malicious remote bolus. 6. The pump must ignore pump alerts indicating that a remote bolus is being transmitted. Additional Resources Patients can contact the 24-hour hotline or visit the Medtronic website for more information. A copy of the field safety notice letter can be viewed or downloaded here. The complete ICS-CERT security advisory can be found here.

Goal Reached Thanks to every supporter — we hit 100%!

Medtronic MiniMed Insulin Pump Remote Bolting Vulnerability Advisory