CVE-2020-27266CWE-603

CVE-2020-27266: vulnerability in SOOIL Developments Co., Ltd Diabecare RS…

Published · Updated

Follow this CVE+ Monitor SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.6%
In short

Insulin pump devices (Diabecare RS, AnyDana-i, AnyDana-A) have a security flaw where attackers nearby can connect via Bluetooth and bypass the login checks, potentially controlling the device without permission.

Technical detail

A client-side authentication bypass in the Bluetooth Low Energy communication stack allows an attacker within physical proximity to establish an unauthenticated connection and circumvent user verification mechanisms. The vulnerability stems from insufficient validation of authentication state on the mobile application side, enabling unauthorized command injection to the medical device.

Summary generated and translated by AI from the official description.
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass user authentication checks via Bluetooth Low Energy.
Affected products
n/a · SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A