CVE-2016-5085

Published: Oct 5, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof meters by sniffing the network and then engaging in an authentication handshake.

Affected (1)

Products: Animas: Onetouch Ping Firmware

Animas

1 product

Onetouch Ping Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Animas Onetouch Ping Firmware	All versions

Running on/with	Platform Versions
Animas Onetouch Ping	All versions

Related CWEs

CWE-330

Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (10)

http://www.kb.cert.org/vuls/id/884840

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.kb.cert.org/vuls/id/BLUU-A9SQRS

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/93351

Source: cret@cert.org

https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pump

Source: cret@cert.org

MitigationTechnical DescriptionThird Party Advisory

https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01

Source: cret@cert.org

http://www.kb.cert.org/vuls/id/884840