CVE-2016-5085

Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof meters by sniffing the network and then engaging in an authentication handshake.

• CWE-330

• http://www.kb.cert.org/vuls/id/884840Third Party Advisory, US Government Resource
• http://www.kb.cert.org/vuls/id/BLUU-A9SQRSThird Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/93351
• https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pumpMitigation, Technical Description, Third Party Advisory
• https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01
• http://www.kb.cert.org/vuls/id/884840Third Party Advisory, US Government Resource
• http://www.kb.cert.org/vuls/id/BLUU-A9SQRSThird Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/93351
• https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pumpMitigation, Technical Description, Third Party Advisory
• https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01

Published

Oct 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5076CloudView NMS before 2.10a allows remote attackers to obtain…
• CVE-2016-5077Netikus EventSentry before 3.2.1.44 has XSS via SNMP.
• CVE-2016-5078Paessler PRTG before 16.2.24.4045 has XSS via SNMP.
• CVE-2016-5080Integer overflow in the rtxMemHeapAlloc function in asn1rt_a…
• CVE-2016-5081ZModo ZP-NE14-S and ZP-IBH-13W devices have a hardcoded root…
• CVE-2016-5084Johnson & Johnson Animas OneTouch Ping devices do not use en…
• CVE-2016-5086Johnson & Johnson Animas OneTouch Ping devices allow remote …
• CVE-2016-5087Alertus Desktop Notification before 2.9.31.1710 on OS X uses…
• CVE-2016-5091Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and …
• CVE-2016-5092Directory traversal vulnerability in Fortinet FortiWeb befor…
• CVE-2016-5093The get_icu_value_internal function in ext/intl/locale/local…
• CVE-2016-5094Integer overflow in the php_html_entities function in ext/st…