Medium severity · published Nov 8, 2019
CVE-2019-13531
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the…
4.6
CVSS
0.4%
EPSS
No
On KEV
Description
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments can be bypassed, allowing for inauthentic instruments to connect to the generator.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VF
Valleylab Ft10 Energy Platform Firmware · Medtronic
2.0.3; 2.1.0 · source: NVD
VL
Valleylab Ls10 Energy Platform Firmware · Medtronic
through 1.20.2 · source: NVD
Affected product
VF
Valleylab Ft10 Energy Platform Firmware
Medtronic
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13531
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13531
global.medtronic.com
https://global.medtronic.com/xg-en/product-security/security-bulletins/valleylab-generator-rfid-vulnerabilities.html
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-311-01
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsma-19-311-01
More from Valleylab Ft10 Energy Platform Firmware
7.8
CVE-2019-13539
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform…
7.5
CVE-2019-13543
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform…
4.6
CVE-2019-13535
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the…