{"containers": {"cna": {"affected": [{"product": "Accent and Anthem", "vendor": "Abbott Laboratories", "versions": [{"status": "affected", "version": "All versions of pacemakers manufactured prior to August 28, 2017"}]}], "datePublic": "2017-08-29T00:00:00", "descriptions": [{"lang": "en", "value": "Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programmers and home monitoring units. Additionally, the Accent and Anthem pacemakers store the optional patient information without encryption. CVSS v3 base score: 3.1, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott has developed a firmware update to help mitigate the identified vulnerabilities."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-311", "description": "Missing encryption of sensitive data CWE-311", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-04-26T09:57:01", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01"}, {"name": "100523", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/100523"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2017-08-29T00:00:00", "ID": "CVE-2017-12716", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Accent and Anthem", "version": {"version_data": [{"version_value": "All versions of pacemakers manufactured prior to August 28, 2017"}]}}]}, "vendor_name": "Abbott Laboratories"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programmers and home monitoring units. Additionally, the Accent and Anthem pacemakers store the optional patient information without encryption. CVSS v3 base score: 3.1, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott has developed a firmware update to help mitigate the identified vulnerabilities."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Missing encryption of sensitive data CWE-311"}]}]}, "references": {"reference_data": [{"name": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01"}, {"name": "100523", "refsource": "BID", "url": "http://www.securityfocus.com/bid/100523"}]}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2017-12716", "datePublished": "2017-08-29T00:00:00", "dateReserved": "2017-08-09T00:00:00", "dateUpdated": "2018-04-26T09:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abbott:accent_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BFF25F4E-CF32-41A5-9AEC-5CF2A1D70732", "versionEndExcluding": "f0b.0e.7e", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abbott:accent:-:*:*:*:*:*:*:*", "matchCriteriaId": "7261AA88-1BD6-4CDF-AFC0-31FD7F52B9E7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abbott:anthem_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6C940D7-5EA3-4D42-8FFE-0C38D2D0065E", "versionEndExcluding": "f0b.0e.7e", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abbott:anthem:-:*:*:*:*:*:*:*", "matchCriteriaId": "4B28402F-D4DF-448B-8ED3-676E0B438331", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abbott:accent_mri_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BFC7CD6D-57F8-4479-A25C-9B9937FD3793", "versionEndExcluding": "f10.08.6c", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abbott:accent_mri:-:*:*:*:*:*:*:*", "matchCriteriaId": "C752B8AA-8990-43DE-AB8B-57329E1E0AE1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abbott:accent_st_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3CCA1805-9253-4267-ACE9-B9F3BBB1549A", "versionEndExcluding": "f10.08.6c", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abbott:accent_st:-:*:*:*:*:*:*:*", "matchCriteriaId": "794620AF-C8D5-4511-B4AF-5E8B4347F558", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programmers and home monitoring units. Additionally, the Accent and Anthem pacemakers store the optional patient information without encryption. CVSS v3 base score: 3.1, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott has developed a firmware update to help mitigate the identified vulnerabilities."}, {"lang": "es", "value": "Los marcapasos Accent y Anthem de Abbott Laboratories fabricados antes del 28 de agosto de 2017 transmiten informaci\u00f3n no cifrada del paciente mediante comunicaciones de radiofrecuencia y unidades de monitorizaci\u00f3n dom\u00e9stica. Adem\u00e1s, los marcapasos Accent y Anthem almacenan la informaci\u00f3n opcional del paciente sin cifrar. Puntuaci\u00f3n base de CVSS v3: 3.1, cadena de vector CVSS: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott ha desarrollado una actualizaci\u00f3n de firmware para ayudar a mitigar las vulnerabilidades identificadas."}], "id": "CVE-2017-12716", "lastModified": "2019-10-09T23:23:11.687", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-04-25T13:29:00.333", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100523"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-311"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}