High severity · published Nov 8, 2019
CVE-2019-13539
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password hashing. While interactive, network-based logons are disabled, and attackers can use the other vulnerabilities within this report to obtain local shell access and access these hashes.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VE
Valleylab Exchange Client · Medtronic
through 3.4 · source: NVD
VF
Valleylab Ft10 Energy Platform Firmware · Medtronic
through 4.0.0 · source: NVD
VF
Valleylab Fx8 Energy Platform Firmware · Medtronic
through 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13539
global.medtronic.com
https://global.medtronic.com/xg-en/product-security/security-bulletins/valleylab-generator-rfid-vulnerabilities.html
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-311-02
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsma-19-311-02
More from Valleylab Exchange Client
7.5
CVE-2019-13543
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform…