| CVE-2017-5149 | Date: (C)2017-02-16 (M)2023-12-22 |
An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 (RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability). The identities of the endpoints for the communication channel between the transmitter and St. Jude Medical's web site, Merlin.net, are not verified. This may allow a man-in-the-middle attacker to access or influence communications between the identified endpoints.
CVSS Score and Metrics +CVSS Score and Metrics -| CVSS V3 Severity: | CVSS V2 Severity: |
| CVSS Score : 8.9 | CVSS Score : 6.8 |
| Exploit Score: 2.2 | Exploit Score: 8.6 |
| Impact Score: 6.0 | Impact Score: 6.4 |
| |
| CVSS V3 Metrics: | CVSS V2 Metrics: |
| Attack Vector: NETWORK | Access Vector: NETWORK |
| Attack Complexity: HIGH | Access Complexity: MEDIUM |
| Privileges Required: NONE | Authentication: NONE |
| User Interaction: NONE | Confidentiality: PARTIAL |
| Scope: CHANGED | Integrity: PARTIAL |
| Confidentiality: LOW | Availability: PARTIAL |
| Integrity: HIGH | |
| Availability: HIGH | |
| | |
