Is CVE-2018-8868 actively exploited?

No active exploitation of CVE-2018-8868 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2018-8868 be exploited remotely?

No. CVE-2018-8868 requires physical access to exploit.

What is the CVSS score of CVE-2018-8868?

CVE-2018-8868 has a CVSS score of 6.2 (MEDIUM).

HOME VULNERABILITIESCVE-2018-8868

MEDIUM

CVE-2018-8868

CWE-749Published: July 3, 2018· Updated: Jun 17, 2026

6.2

CVSS v3.1

Official Description

Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality.

NVD Source

Technical Analysis

CVE-2018-8868 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.2.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.