High severity · published Nov 8, 2019
CVE-2019-13543
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform…
7.5
CVSS
2%
EPSS
No
On KEV
Description
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use multiple sets of hard-coded credentials. If discovered, they can be used to read files on the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VE
Valleylab Exchange Client · Medtronic
through 3.4 · source: NVD
VF
Valleylab Ft10 Energy Platform Firmware · Medtronic
through 4.0.0 · source: NVD
VF
Valleylab Fx8 Energy Platform Firmware · Medtronic
through 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13543
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13543
global.medtronic.com
https://global.medtronic.com/xg-en/product-security/security-bulletins/valleylab-generator-rfid-vulnerabilities.html
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-311-02
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsma-19-311-02
More from Valleylab Exchange Client
7.8
CVE-2019-13539
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform…