VIR Vulnerability Intelligence Relay

CVE-2017-5149

high
Published 2017-02-13 · Modified 2026-05-13
CVSS v3
8.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
CVSS v2
6.8
VIR risk
8.9

Description

An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 (RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability). The identities of the endpoints for the communication channel between the transmitter and St. Jude Medical's web site, Merlin.net, are not verified. This may allow a man-in-the-middle attacker to access or influence communications between the identified endpoints.

Predictions

Exploit likelihood
93%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: ics-cert@hq.dhs.gov — https://ics-cert.us-cert.gov/advisories/ICSMA-17-009-01A

References

CWEs

CWE-476

Verify integrity in audit chain (admin only). AS-IS.