Medium severity · published Mar 26, 2019
CVE-2019-6540
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D,…
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Amplia Crt-d Firmware · Medtronic
All versions, or not specified · source: NVD
C2
Carelink 2090 Firmware · Medtronic
All versions, or not specified · source: NVD
CM
Carelink Monitor 2490c Firmware · Medtronic
All versions, or not specified · source: NVD
CC
Claria Crt-d Firmware · Medtronic
All versions, or not specified · source: NVD
CC
Compia Crt-d Firmware · Medtronic
All versions, or not specified · source: NVD
CC
Concerto Crt-d Firmware · Medtronic
All versions, or not specified · source: NVD
CI
Concerto II Crt-d Firmware · Medtronic
All versions, or not specified · source: NVD
CC
Consulta Crt-d Firmware · Medtronic
All versions, or not specified · source: NVD
EI
Evera Icd Firmware · Medtronic
All versions, or not specified · source: NVD
MI
Maximo II Crt-d Firmware · Medtronic
All versions, or not specified · source: NVD
MI
Maximo II Icd Firmware · Medtronic
All versions, or not specified · source: NVD
MI
Mirro Icd Firmware · Medtronic
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6540
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6540
Broken Link
http://www.securityfocus.com/bid/107544
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01
More from Amplia Crt-d Firmware
6.5
CVE-2019-6538
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D,…
