CVE-2019-10964: Medtronic Minimed 508 Firmware

High severity, CVSS 7.1. EPSS: 1.2% chance of exploitation in the next 30 days.

Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.

Affected products

• Medtronic Minimed 508 Firmware: any version
• Medtronic Minimed Paradigm 511 Firmware: any version
• Medtronic Minimed Paradigm 512 Firmware: any version
• Medtronic Minimed Paradigm 515 Firmware: any version
• Medtronic Minimed Paradigm 522 Firmware: any version
• Medtronic Minimed Paradigm 522k Firmware: any version
• Medtronic Minimed Paradigm 523 Firmware: up to and including 2.4a
• Medtronic Minimed Paradigm 523k Firmware: up to and including 2.4a
• Medtronic Minimed Paradigm 712 Firmware: any version
• Medtronic Minimed Paradigm 712e Firmware: any version
• Medtronic Minimed Paradigm 715 Firmware: any version
• Medtronic Minimed Paradigm 722 Firmware: any version
• Medtronic Minimed Paradigm 722k Firmware: any version
• Medtronic Minimed Paradigm 723 Firmware: up to and including 2.4a
• Medtronic Minimed Paradigm 723k Firmware: up to and including 2.4a
• Medtronic Minimed Paradigm Veo 554 Firmware: up to and including 2.6a
• Medtronic Minimed Paradigm Veo 554cm Firmware: up to and including 2.7a
• Medtronic Minimed Paradigm Veo 754 Firmware: up to and including 2.6a
• Medtronic Minimed Paradigm Veo 754cm Firmware: affected versions not specified

Published 2019-06-28. Last modified 2026-06-17.