Every CVE Search/ Get API key

CVE-2023-25931

Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue

6.4 Medium

Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which has greater control over therapy parameters than the patient app. Changes still cannot be made outside of the established therapy parameters of the programmer. For unauthorized access to occur, an individual would need physical access to the Smart Programmer.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
High

Exploit likelihood

0.27%Down 0.6 points since Mar 2, 2023
90%50%10%1%

What each source reports

CVE List Score used 6.4

Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue

Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which has greater control over therapy parameters than the patient app. Changes still cannot be made outside of the established therapy parameters of the programmer. For unauthorized access to occur, an individual would need physical access to the Smart Programmer.

Record
CVE-2023-25931
CVSS 3.1
6.4 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Weakness
CWE-620
Updated
2026-11-02
EUVDEUVD-2023-29819 6.4

Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which has greater control over therapy parameters than the patient app. Changes still cannot be made outside of the established therapy parameters of the programmer. For unauthorized access to occur, an individual would need physical access to the Smart Programmer.

Record
EUVD-2023-29819
CVSS 3.1
6.4 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-crgr-72p3-3g72 6.8

Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart...

Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which has greater control over therapy parameters than the patient app. Changes still cannot be made outside of the established therapy parameters of the programmer. For unauthorized access to occur, an individual would need physical access to the Smart Programmer.

Record
GHSA-crgr-72p3-3g72
CVSS 3.1
6.8 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
NVD 6.4

Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which has greater control over therapy parameters than the patient app. Changes still cannot be made outside of the established therapy parameters of the programmer. For unauthorized access to occur, an individual would need physical access to the Smart Programmer.

Record
CVE-2023-25931
CVSS 3.1
6.4 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS 3.1
6.8 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-620, CWE-287
Updated
2026-11-02

Affected products

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-25931 is a medium vulnerability (CVSS 6.4) in Medtronic Interstim X Clinician, published March 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. No source names a fixed version.

References

MoveEnter Open