Pelvic Health InterStim™ Micro and InterStim X™ Clinician Application Security Update

March 2, 2023

Summary

Medtronic has identified a potential issue related to its InterStim™ therapy and how passwords are saved within the Smart Programmer’s clinician app.

Contact information is at the bottom of this bulletin in the “For More Information” section.

Impacted products

Patients with bladder and/or bowel control issues may have an implanted Medtronic InterStim™ neurostimulator placed in the upper buttock area. The therapy this device delivers, which helps patients control bladder and/or bowel function, can be controlled by the patient and their healthcare provider through an app on a handheld mobile device, called a Smart Programmer.

The apps on the handheld mobile devices are impacted by a vulnerability explained further in the “Vulnerability Overview” section. Pictures of the impacted apps are below:

Vulnerability Overview

Through routine monitoring, Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which has greater control over therapy parameters than the patient app.  Changes still cannot be made outside of the established therapy parameters of the programmer.  For unauthorized access to occur, an individual would need physical access to the Smart Programmer. 

The vulnerability exists under certain reset conditions. It could lead to the clinician application’s custom password being reset to a default password. 

For more information:

Additional Details:

Cybersecurity professionals may find the following technical information useful for tracking and risk rating purposes:

• The vulnerability has been assigned a CVE number, CVE-2023-25931
• The CVSS score for this vulnerability is 6.4.