Unauthenticated RF insulin-delivery control

1. Summary

The proprietary wireless RF communication protocol that Medtronic MiniMed 508 and Paradigm-series insulin pumps use to talk to their accessory ecosystem (blood glucose meter, remote controller, CareLink USB, and continuous glucose monitor) implements no authentication or authorization for received commands [1][2]. An attacker within adjacent RF range can therefore intercept, replay, modify, or inject protocol traffic that the pump treats as legitimate [1][5]. Successful command injection lets the attacker change pump settings and directly control insulin delivery [1][5]. The defect is a design property of the legacy RF protocol and hardware rather than a bug in a discrete, updatable software module [2].

2. Affected products & versions

Remediation across all affected models is device replacement, not a version upgrade; the “fixed version” column is “none” because Medtronic determined the legacy pumps cannot be adequately updated [3]. The operational consequences of that no-patch status are treated in Sections 6 and 7.

3. The vulnerability in detail

The vulnerability lives in the proprietary wireless RF communication interface of Medtronic’s MiniMed 508 and Paradigm-series insulin pumps — the radio channel that the pump uses to exchange data with its companion devices, including the paired blood glucose meter, the remote controller, the CareLink USB uploader, and glucose monitors [1][2]. This is not a bug in a discrete, updatable software module. No specific source file, firmware component, or code path is named in the public advisories; the defect is characterized as a property of the protocol and the legacy hardware that speaks it [2].

The root cause is the absence of authentication and authorization in the RF protocol itself [1][2]. When the pump receives a command over its RF channel, the protocol provides no cryptographic verification that the command originated from a legitimately paired accessory. There is no shared secret, no signed or MAC-protected message, and no session establishment that would let the pump distinguish a genuine remote controller or meter from an arbitrary radio transmitter within range. Because commands carried over this channel can change device configuration and drive the actuator that delivers insulin, an unauthenticated command that the pump accepts is a command that changes therapy on the basis of an unverified instruction [1][5]. (The exact internal message-handling and frame-acceptance logic — including whether the pump listens continuously and what constitutes a “well-formed” frame — is not documented in the cited sources. What the sources do establish is the missing-authentication/authorization property and the resulting inject/replay/modify/intercept capability [1][2][5].)

The mechanism of exploitation follows directly from that missing check. The pump receives commands from legitimate accessories over its proprietary RF channel [1][2]. An attacker who is physically near the target — this is adjacent-network access, not internet-remote access — and who possesses the appropriate RF equipment can passively observe the traffic (intercept), retransmit previously captured legitimate frames (replay), alter fields inside captured frames before retransmitting them (modify), or synthesize entirely new command frames (inject) [1][5]. Any of the active variants, if accepted by the pump, changes pump state [1][5]. The preconditions that gate the attack are threefold: the attacker must be within RF proximity of the pump; the attacker must have specialized skills and specialized RF hardware, which is why the attack complexity is rated high; and the target pump must be running an affected firmware version [5]. Notably, the attack requires no user credentials, no user interaction, and no physical contact with the device — the radio interface is the entire attack surface [1][5].

A concrete exploitation chain looks like this [1][5]:

1. The attacker positions themselves within adjacent RF range of a target MiniMed 508 or Paradigm-series pump running affected firmware.
2. Using specialized RF equipment, the attacker monitors and intercepts the proprietary wireless traffic exchanged between the pump and its accessories.
3. The attacker captures legitimate command frames and/or reverse-engineers the unauthenticated protocol structure.
4. Because the pump enforces no authentication or authorization, the attacker replays captured commands, modifies command fields, or injects newly crafted commands.
5. The pump accepts the unauthorized commands and changes its settings and/or issues insulin-delivery commands.

The terminal, physiological consequence of step 5 — and why that consequence matters — is deferred to Section 6, per the bug-first separation of concerns.

The general class of attack — RF-based hijacking of insulin-pump communications — was demonstrated in earlier independent research associated with researchers such as Jay Radcliffe and Barnaby Jack, which establishes feasibility of the class [5].

In CWE terms, the defect is fundamentally an improper access control problem: the system fails to restrict which actors may issue commands that affect its behavior. CISA’s advisory assigns CWE-284 (Improper Access Control) as the primary weakness [1][2]. NVD additionally maps it to CWE-287 (Improper Authentication) — the pump never verifies the identity of the sender — and CWE-863 (Incorrect Authorization) — even without verified identity, the pump grants the sender full command authority [1]. The pump answers to anyone who knows how to talk to it, and the protocol never gave it a way to tell friend from foe.

4. Discovery & timeline

CISA/Medtronic credited the discovery to Medtronic’s internal research team, whose work was informed by prior research from six external researchers: Nathanael Paul, Jay Radcliffe, Barnaby Jack, Billy Rios, Jonathan Butts, and Jesse Young [4][5]. Coordinated disclosure was handled jointly by DHS/ICS-CERT (now CISA), the FDA, and Medtronic [4].

The public disclosure milestones: the FDA issued its safety communication on June 27, 2019, addressing the wireless communication systems linking the pumps to glucose meters, CGMs, remote controllers, and data-management devices [3]. The coordinated ICS-CERT/Medtronic advisory (ICSMA-19-178-01) was issued in the same June 27–28, 2019 window [2][4]. The FDA identified approximately 4,000 potentially affected US patients [3]. On November 5, 2019, the FDA escalated the recall to Class I — its most serious category, reserved for situations where device use may cause serious injury or death [7]. The exact start date of the coordinated-disclosure process (researcher notification through to public advisory) is not documented in the available sources.

5. Technical reference

• CVE: CVE-2019-10964 [1]
• CWE: CWE-284 Improper Access Control (primary, CISA); CWE-287 Improper Authentication and CWE-863 Incorrect Authorization (NVD) [1][2]
• CVSS v3.1 (ICS-CERT): base 7.1 HIGH, vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H [1]
• CVSS v3.0 (NIST): base 8.8 HIGH, vector CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [1]

What the metrics mean here: both vectors agree on Attack Vector: Adjacent (AV:A) — this is a proximity/RF attack, not an internet-remote one — and on no privileges required and no user interaction (PR:N/UI:N), reflecting that the radio interface accepts commands from anyone in range without credentials or victim action. The two scorings differ on two axes. First, Attack Complexity: the ICS-CERT v3.1 vector rates it High (AC:H), capturing the specialized skills and RF equipment needed, whereas the older NVD v3.0 vector rates it Low (AC:L), which is the main driver of the higher 8.8 score. Second, Confidentiality: v3.1 rates it Low (C:L) while v3.0 rates it High (C:H). Both rate Integrity and Availability High (I:H/A:H), reflecting that an attacker can alter pump settings/therapy (integrity) and stop delivery (availability). The real-world significance of those Integrity/Availability ratings — the fact that they map onto physiological harm rather than mere data corruption — is analyzed in Section 6.

No code or commit references exist, consistent with the flaw being characterized as a hardware/protocol design defect rather than a fixable software bug [2][3].

6. Consequence & CFSE path analysis

The real-world consequence is that a nearby attacker with the right radio gear can make an affected pump deliver too much insulin (driving the patient toward hypoglycemia) or stop delivering insulin (driving the patient toward hyperglycemia and diabetic ketoacidosis) — outcomes that can be life-threatening [3][6]. A secondary, non-physical consequence is that the same unauthenticated RF traffic can be passively intercepted, exposing the patient’s dosing, treatment, and pump operational state [1][5]. This is the section where the Integrity/Availability CVSS impacts (Section 5) resolve into their concrete meaning: “integrity/availability impact” here denotes physiological harm to a patient, not just data corruption or downtime.

The CFSE Path Score decomposes this into two co-dominant risk paths, both banded CRITICAL, and the record is deliberately scored UNDER-direction relative to the published CVSS baselines (v3.1 7.1 HIGH, v3.0 8.8 HIGH) — meaning the CFSE verdict is more severe than the CVSS numbers would suggest on their own. The reason CVSS and the CFSE path verdict diverge is that CVSS compresses a physiological, life-safety actuation impact into the same “Integrity/Availability: High” buckets it would use for ordinary data corruption, and it has no dimension for fleet-wide reusability, per-patient scale limits, or the fact that no software remediation is possible. CFSE models those explicitly.

CFSE metric legend (dimensions used below; higher = more severe unless noted):

• PH — Physical-Harm potential (0 = none … 4 = life-threatening)
• AT — Actuation reach (degree to which the path drives a physical actuator)
• CH — Consequence severity of the terminal event
• RE — Reachability of the attack surface
• EC — Execution complexity / attacker capability required
• EX — Exposure of the surface to a would-be attacker
• SR — Scale of reusability of the underlying weakness (fleet-wide vs. one-off)
• SX — Scale limiter from per-target constraints (e.g., physical proximity caps reach)
• OR — Operational Recovery burden (0 = trivial patch … 4 = recall / hardware replacement)

Applying that legend:

• DEVICE_CONTROL_SAFETY path (banded CRITICAL): an in-range attacker exploits the unauthenticated proprietary RF protocol to inject/replay/modify commands and control insulin delivery, causing hypoglycemia, hyperglycemia, or DKA that can be life-threatening [3][6]. Physical-harm potential PH:4, actuation AT:3, consequence CH:3.
• DATA_PRIVACY path (banded CRITICAL): passive interception of the same RF traffic exposes patient dosing, treatment, and pump operational state with no physical effect [1][5]. PH:0, AT:2.

Both paths share adjacent-RF reachability with specialist-but-reproducible execution (RE:2, EC:2, EX:2), a fleet-wide reusable protocol weakness (SR:4), per-patient proximity that limits scale (SX:2), and — critically — no possible software patch, which forces recall and hardware replacement (OR:4) [3]. The overall path_verdict is CRITICAL, driven by the safety-relevant actuation consequence on the DEVICE_CONTROL_SAFETY path. The November 2019 escalation to a Class I recall — the FDA’s most serious category, reserved for situations where use may cause serious injury or death — independently reinforces this banding [7].

7. Remediation & mitigations

No software patch is possible for this vulnerability; Medtronic determined the legacy MiniMed 508 and Paradigm pumps cannot be adequately updated to close the RF protocol weakness [3]. Because the defect is a design property of the legacy protocol/hardware rather than a fixable code path (Section 3), there is no firmware update that can add the missing authentication/authorization, and the definitive remediation is therefore device replacement:

• Recall and replace. Medtronic recalled the affected pumps and advised patients to consult their healthcare providers about switching to a newer Medtronic pump model with enhanced cybersecurity; the MiniMed 670G is cited as an example replacement model [3][5].
• Interim, patient-controlled risk reduction (per FDA/CISA guidance, applicable while awaiting replacement) [3]:
• Keep the pump and its connected/paired devices under the patient’s physical control at all times, since the attack requires RF proximity.
• Be attentive to pump alarms and notifications that could indicate unexpected setting or delivery changes.
• Monitor blood glucose closely and act on abnormal readings.
• Avoid disclosing or leaving connectable accessories where an attacker could observe or interact with the pairing/RF environment (consistent with the missing-authentication defect).

These are the only measures grounded in this specific flaw. Because the exploited surface is a short-range radio interface with no authentication, generic network/SOC controls (firewalls, network segmentation, IDS signatures) do not apply and are intentionally omitted.

8. Sources

[1] CVE-2019-10964 Detail — NVD (NIST) — https://nvd.nist.gov/vuln/detail/CVE-2019-10964 — Canonical CVE record; grounds the improper-access-control/unauthenticated-RF description, full affected model+version list, both CVSS vectors, and CWE mappings. Credibility: primary advisory.

[2] Medtronic MiniMed 508 and Paradigm Series Insulin Pumps — CISA / ICS-CERT advisory ICSMA-19-178-01 — https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-178-01 — Primary government ICS-Medical advisory; details CWE-284 in the wireless RF protocol, inject/replay/modify/intercept capability, adjacent/high-skill profile, researcher credits, and no-patch/migrate mitigation. Credibility: primary advisory.

[3] FDA warns patients and health care providers about potential cybersecurity concerns with certain Medtronic insulin pumps (June 27, 2019) — U.S. FDA (via PR Newswire) — https://www.prnewswire.com/news-releases/fda-warns-patients-and-health-care-providers-about-potential-cybersecurity-concerns-with-certain-medtronic-insulin-pumps-300876422.html — Official FDA safety communication; confirms ~4,000 affected US patients, unpatchable legacy pumps, replacement-only mitigation, no confirmed harm, and the hypoglycemia/hyperglycemia/DKA consequence. Credibility: primary advisory.

[4] Medtronic recalls vulnerable MiniMed insulin pumps — Help Net Security — https://www.helpnetsecurity.com/2019/06/28/hackable-medtronic-insulin-pumps-recall/ — Coordinated-disclosure recall narrative tying DHS/CISA, Medtronic, and FDA together; corroborates CVSS 7.1, the RF protocol weakness class, internal-team discovery, and recall/replace remediation. Credibility: reputable press.

[5] Some Medtronic Insulin Pumps Vulnerable to Hacker Attacks — SecurityWeek — https://www.securityweek.com/some-medtronic-insulin-pumps-vulnerable-hacker-attacks/ — Technical press summary of inject/replay/modify over RF, settings-change and insulin-control impact, affected models, not-remotely-exploitable/high-skill profile, and the 670G replacement example. Credibility: reputable press.

[6] Medtronic recalls MiniMed insulin pumps as FDA warns about hacking risk — CNN — https://www.cnn.com/2019/06/27/health/medtronic-insulin-pump-recall-cybersecurity-fda-bn — Mainstream corroboration of the recall action, the over-delivery/stopped-delivery safety framing, and that wireless connectivity is the exploited surface. Credibility: reputable press.

[7] Medtronic Insulin Pump recall lands in FDA’s top risk category after cybersecurity warning — MedTech Dive — https://www.medtechdive.com/news/fda-warns-hackers-could-make-medtronic-pumps-deliver-insulin/557847/ — Reports the November 5, 2019 escalation to a Class I recall (potential for serious injury/death), reinforcing the CRITICAL safety banding. Credibility: reputable press.