title: Improper Access Control for Boston Scientific Zoom Latitude
description: A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.
problem types: CWE-284 Improper Access Control
affected:
{
product: ZOOM LATITUDE
vendor: Boston Scientific
versions:
status: affected, version: Model 3120
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
version: 3.1
]
workarounds: Boston Scientific is in the process of transitioning all users to a replacement programmer with enhanced security,  the LATITUDE Programming System, Model 3300. Boston Scientific will not issue a product update to address the identified vulnerabilities in the ZOOM LATITUDE Programming System, Model 3120.