CVE-2018-14781
Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay
Medtronic MiniMed MMT
devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay
Medtronic MiniMed MMT
devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.
- Record
CVE-2018-14781- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-294
- Updated
- 2026-11-02
EUVDEUVD-2018-6665
Medtronic MiniMed MMT
devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.
- Record
EUVD-2018-6665- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cv4q-4xgp-cr7m
Medtronic MMT 508 MiniMed insulin pump, 522 / MMT - 722 Paradigm REAL-TIME, 523 / MMT - 723...
Medtronic MMT 508 MiniMed insulin pump, 522 / MMT - 722 Paradigm REAL-TIME, 523 / MMT - 723 Paradigm Revel, 523K / MMT - 723K Paradigm Revel, and 551 / MMT - 751 MiniMed 530G The models identified above, when paired with a remote controller and having the "easy bolus" and "remote bolus" options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.
- Record
GHSA-cv4q-4xgp-cr7m- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-287, CWE-294
- Updated
- 2026-11-02
NVD
Medtronic MiniMed MMT
devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.
- Record
CVE-2018-14781- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 2.9 Low
AV:A/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-294, CWE-287
- Updated
- 2026-11-02
Affected products
- medtronic mmt – 511 pump paradigm
- medtronic mmt – 512 / mmt – 712 paradigm x12
- medtronic mmt – 515 / mmt – 715 paradigm x15
- medtronic mmt – 522 / mmt – 722 paradigm real-time
- medtronic mmt – 522(k) / mmt – 722(k) paradigm real-time
- medtronic mmt – 523 / mmt – 723 paradigm revel
- medtronic mmt – 523(k) / mmt – 723(k) paradigm
- medtronic mmt – 551 / mmt – 751 minimed 530g
- medtronic mmt – 554 / mmt – 754 minimed veo
- medtronic mmt- 508 - minimed pump
- medtronicdiabetes 508 minimed insulin pump firmware
- medtronicdiabetes 522 paradigm real-time firmware
Show 7 moreShow less
- medtronicdiabetes 523 paradigm revel firmware
- medtronicdiabetes 523k paradigm revel firmware
- medtronicdiabetes 551 minimed 530g firmware
- medtronicdiabetes 722 paradigm real-time firmware
- medtronicdiabetes 723 paradigm revel firmware
- medtronicdiabetes 723k paradigm revel firmware
- medtronicdiabetes 751 minimed 530g firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-14781 is a medium vulnerability (CVSS 5.3) in Medtronic Mmt – 511 Pump Paradigm, published August 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. No source names a fixed version.