CVE-2016-5086
critical
CVSS v3
9.8
CVSS v2
9.3
VIR risk
9.8
Description
Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cret@cert.org — https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pump
References
- http://www.kb.cert.org/vuls/id/884840
- http://www.kb.cert.org/vuls/id/BLUU-A9SQRS
- http://www.securityfocus.com/bid/93351
- https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pump
- https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01
- http://www.kb.cert.org/vuls/id/884840
- http://www.kb.cert.org/vuls/id/BLUU-A9SQRS
- http://www.securityfocus.com/bid/93351
- https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pump
- https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01
CWEs
CWE-287
Verify integrity in audit chain (admin only). AS-IS.