CVE-2017-12712
No exploitation reported by the sources we read.
- Published2018-04-25
- Fixed inf0b.0e.7e
- WeaknessCWE-287
Am I affected?
Debian, Ubuntu or Red Hat sometimes backport a fix without changing the upstream version number: such a version reads « to verify », never « affected ».With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.
Description
The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3 base score: 7.5, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
Timeline
dates in UTC- 2018-04-2513:29CVE publishedNVD
Observed activity
isMalicious corpus · updated 2026-10-23 21:37 UTCBlock these indicators
- Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2017-12712?format=txt
- CSV export: https://api.ismalicious.com/edl/cve/CVE-2017-12712?format=csv
- TAXII collection of exploited CVEs
- The EDL and CSV take an API key on the Pro plan.
Versions per branch
NVD| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| — | < f0b.0e.7e | f0b.0e.7e | NVD |
| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| — | < f10.08.6c | f10.08.6c | NVD |
| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| — | < f10.08.6c | f10.08.6c | NVD |
4 more products in the sources.
as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.
Distribution builds and vendor advisories
Packages from OSV.dev and products from the vendors' CSAF advisories.
version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.
Vendor advisories
Abbott Laboratories Defibrillator
Fortify Assura: manufactured and distributed prior to April 1 2018 · Promote Quadra: manufactured and distributed prior to April 1 2018 · Current: manufactured and distributed prior to April 1 2018 · +8 more
ICSMA-17-241-01_Abbott Laboratories ' Accent/Anthem, Accent MRI, Assurity/Allure, and Assurity MRI Pacemaker Vulnerabilities
Accent MRI: manufactured prior to August 28 · Assurity/Allure: manufactured prior to August 28 · Assurity MRI: manufactured prior to August 28 · +1 more
Fix
- Update Abbott accent firmware to f0b.0e.7e
- Vendor fix CISA ICSMA-18-107-01 · 11 productsAbbott has developed a firmware update to help mitigate the identified vulnerabilities.
- Vendor fix CISA ICSMA-18-107-01 · 11 productsThe firmware update provides additional security to reduce the risk of unauthorized access by bypassing authentication to the following high voltage device families that utilize wireless radio frequency (RF) communication: Fortify, Fortify Assura, Quadra Assura, Quadra Assura MP, Unify, Unify Assur…
- Vendor fix CISA ICSMA-18-107-01 · 11 productsThe firmware update can be applied to an eligible implanted ICD or CRT-D via the Merlin PCS Programmer by a healthcare provider. Abbott and FDA have recommended the update to all eligible patients at the next regularly scheduled visit or when appropriate depending on the preferences of the patient …
- Vendor fix CISA ICSMA-18-107-01 · 11 productsAbbott states that firmware updates should be approached with caution. As with any software update, firmware updates can cause devices to malfunction. Potential risks include discomfort due to back-up VVI pacing settings, reloading of previous firmware version due to incomplete upgrade, inability t…
- Vendor fix CISA ICSMA-18-107-01 · 11 productsWhile not intended to serve as a substitute for clinician judgment as to whether the firmware update is advisable for a particular patient, the Cybersecurity Medical Advisory Board recommends the following:
- Vendor fix CISA ICSMA-18-107-01 · 11 productsAbbott 's older generation devices (i.e., Current and Promote) are not capable of accepting the firmware update due to technology limitations. If healthcare providers and patients have any concerns relating to device cybersecurity for those patients implanted with Current/Promote devices, providers…
Detection
- Nuclei template
- none so far ProjectDiscovery
- Exploit-DB
- no entry Exploit-DB
- Proof-of-concept repositories
- none listed PoC-in-GitHub
Sources
- NVDCVSS 3.08.8read 2026-10-23
- NVDCVSS 2.08.3read 2026-10-23
- CNAweakness (CWE)CWE-287read 2026-10-23
- NVDweakness (CWE)CWE-287read 2026-10-23
- FIRST EPSSEPSS score1.0 %2026-10-23
Technical details
- CVSS v3 Vector
- CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- 2018-04-25
- Last Modified
- 2026-06-17
- NVD status
- Modified
Frequently asked questions
What is CVE-2017-12712?
Is CVE-2017-12712 actively exploited?
What is the CVSS score for CVE-2017-12712?
Hear about the next vulnerability in your software
Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».
No credit card required · No monthly cap on website lookups · 250 API requests/month
Go further
- Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
- Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.
Related vulnerabilities
Same product first, then the same vendor advisory and the same publication week.