Boston Scientific
Vulnerability disclosure program on Self-hosted bostonscientific.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 7
- Public CVEs
- 7
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Note that at this time, Boston Scientific does not have a bug bounty program in place.
- Response
-
Within 5 days
We will acknowledge receiving your report within five (5) business days.
- Safe harbor
-
Partial
Boston Scientific welcomes any research conducted and submitted in good faith
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
7 assets you may test.
Hardware and IoT 3
- capital equipment
- implants
- on-market medical devices
Domains 1
- bostonscientific.com
Products and areas 3
- Boston Scientific products that contain software
- mobile medical applications
- Software as a Medical Device
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Boston Scientific's policy. "We" in these lines means the program, not this site.
While testing
-
Never perform security testing on devices actively in use or on those devices that will be used for patient care delivery after your investigation.
-
You must adhere to the laws of the U.S. and your locality.
-
do not submit any data that contains individually identifiable health information
-
Please communicate with Boston Scientific first about your findings, so together we can work out a mutually agreed-upon disclosure plan.
-
Boston Scientific expects that the intent of your testing is not to cause harm to patients, customers, or Boston Scientific.
Not accepted
-
technical support information on our products
-
adverse events
-
product quality complaints
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2021-38392 | A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world. | Medium 6.5 | 4 Oct 2021 |
| CVE-2021-38394 | An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted. | Medium 6.2 | 4 Oct 2021 |
| CVE-2021-38396 | The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An attacker could leverage this weakness to install unauthorized software using a specially crafted USB. | Medium 6.5 | 4 Oct 2021 |
| CVE-2021-38398 | The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access to the affected device could exploit these vulnerabilities. | Medium 6.5 | 4 Oct 2021 |
| CVE-2021-38400 | An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password. | Medium 6.9 | 4 Oct 2021 |
| CVE-2017-14012 | Boston Scientific ZOOM LATITUDE PRM Model 3120 does not encrypt PHI at rest. CVSS v3 base score: 4.6; CVSS vector string: AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. | Medium 4.6 | 1 May 2018 |
| CVE-2017-14014 | Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removable media. CVSS v3 base score: 4.6; CVSS vector string: AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. | Medium 4.6 | 1 May 2018 |