CVE-2017-5149

8.9 highEPSS 1.2%

An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 (RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability). The identities of the endpoints for the communication channel between the transmitter and St. Jude Medical's web site, Merlin.net, are not verified. This may allow a man-in-the-middle attacker to access or influence communications between the identified endpoints.

Severity

CVSS 3.1

8.9 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
CWE: CWE-476
Published: 2017-02-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

abbott:merlin\@home_firmware

References

http://www.securityfocus.com/bid/95331
https://ics-cert.us-cert.gov/advisories/ICSMA-17-009-01A
http://www.securityfocus.com/bid/95331
https://ics-cert.us-cert.gov/advisories/ICSMA-17-009-01A

Check your stack JSON