CVE-2019-6540

Description

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.

CVSS 3.1

6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.19% probability · 9th percentile

CISA KEV

Not listed

Weakness

CWE-319

Affected

medtronic/mycarelink monitor 24950 firmware · medtronic/mycarelink monitor 24952 firmware · medtronic/carelink monitor 2490c firmware · medtronic/carelink 2090 firmware · medtronic/amplia crt-d firmware · medtronic/claria crt-d firmware · medtronic/compia crt-d firmware · medtronic/concerto crt-d firmware · medtronic/concerto ii crt-d firmware · medtronic/consulta crt-d firmware · medtronic/evera icd firmware · medtronic/maximo ii crt-d firmware · medtronic/maximo ii icd firmware · medtronic/mirro icd firmware · medtronic/nayamed nd icd firmware · medtronic/primo icd firmware · medtronic/protecta icd firmware · medtronic/protecta crt-d firmware · medtronic/secura icd firmware · medtronic/virtuoso icd firmware · +3 more

Source

ics-cert@hq.dhs.gov

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.