Security readout for executives and security teams
Plain-English summary
CVE-2018-10622 affects Medtronic MyCareLink 24950 and 24952 patient monitors. The device stores per-product credentials in a recoverable format. With physical access, an attacker could use those credentials to modify encrypted drive data. This is not listed in CISA KEV, and the provided sources do not indicate active exploitation.
Executive priority
Treat as a moderate medical-device security issue. It is not a broad remote compromise scenario, but affected monitors may handle sensitive clinical data. Prioritize inventory, physical custody controls, and review of Medtronic/CISA guidance, especially where devices are shared, stored, shipped, or used outside controlled facilities.
Technical view
The CVE is CWE-313: cleartext or recoverable credential storage. Affected products are Medtronic 24950 and 24952 MyCareLink Monitor, all versions. CVSS 3.1 is 6.8 with AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning physical access is required but impact to confidentiality, integrity, and availability is rated high.
Likely exposure
Exposure is most relevant to healthcare providers, clinics, and patients using Medtronic 24950 or 24952 MyCareLink monitors. Risk depends heavily on physical custody of the monitor. The source bundle does not identify remote exploitation or network-based exposure for this CVE.
Exploitation context
An attacker would need physical access to an affected monitor. The issue involves recoverable per-product credentials that could be used to modify encrypted drive data. No KEV listing or cited source in the bundle supports active exploitation.
Researcher notes
Evidence supports physical-access exploitation and recoverable credential storage. The bundle identifies affected products and CVSS details but does not provide exploit code, active exploitation evidence, or a specific patch statement. Avoid assuming remote attack paths or fixes beyond vendor guidance.
Mitigation direction
- Inventory Medtronic 24950 and 24952 MyCareLink monitors in use or storage.
- Review Medtronic and CISA advisory guidance before changing clinical workflows.
- Maintain physical control of monitors and limit unsupervised access.
- Inspect handling, storage, and return processes for tampering opportunities.
- Coordinate remediation decisions with biomedical engineering and clinical leadership.
Validation and detection
- Confirm whether any 24950 or 24952 monitors are deployed.
- Verify device custody controls for patient, clinic, and storage locations.
- Check Medtronic advisory for current product-specific guidance.
- Document whether compensating physical security controls are in place.
- Track the CVE as not currently listed in CISA KEV.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-313: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2018-10622 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H0.95.9icscertVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- 105042CVE reference, icscert
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-219-01CVE reference, icscert
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2018/icsma-18-219-01.jsonCVE reference, icscert
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-219-01CVE reference, CVE · x_refsource_MISC, x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cleartext Storage in a File or on Disk
Cleartext Storage in a File or on Disk represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.