CVE-2020-27266
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.6%
exploitation probability
0.6%top 54% of all CVEs
observed exploitation
nono source reports it
In short
Insulin pump devices (Diabecare RS, AnyDana-i, AnyDana-A) have a security flaw where attackers nearby can connect via Bluetooth and bypass the login checks, potentially controlling the device without permission.
Technical detail
A client-side authentication bypass in the Bluetooth Low Energy communication stack allows an attacker within physical proximity to establish an unauthenticated connection and circumvent user verification mechanisms. The vulnerability stems from insufficient validation of authentication state on the mobile application side, enabling unauthorized command injection to the medical device.
Summary generated and translated by AI from the official description.
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass user authentication checks via Bluetooth Low Energy.