by Kastro
Paper/Archive/CVE-2023-31222

CVE-2023-31222

Medtronic Paceart Optima — Medtronic Paceart MSMQ Deserialization of Untrusted Data

EPSS 28%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.1.981 × 2019.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorized user to impact a healthcare delivery organization’s Paceart Optima system cardiac device causing data to be deleted, stolen, or modified, or the Paceart Optima system being used for further network penetration via network connectivity.

Affected

ProductAffectedFixed inSource
Paceart OptimaVersions 1.11 and earlier–CNA

Scores by source

Medtronic (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refglobal.medtronic.com/xg-en/product-security/security-bulletins/paceart-optima-system.html