Medtronic N'Vision Clinician Programmer (Update A)
The affected product does not encrypt the following sensitive information while at rest: PII - Personally Identifiable Information. Some combination of personal data that enables the unique identification of an individual. PII is defined as information that can be used to distinguish or trace an individual 's identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.PHI - Protected Health Information. Some combination of PII and associated health related data.CVE-2018-8849 has been assigned to this vulnerability. A CVSS v3 base score of 4.6 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 Application Card and sufficient technical capability can modify the contents of this card, including the binary executables. If modified to bypass protection mechanisms, this malicious code will be run when the card is inserted into an 8840 Clinician Programmer.CVE-2018-10631 has been assigned to this vulnerability. A CVSS v3 basescore of 6.3 has been assigned; the CVSS vector string is (AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).