CVEvulnerability

CVE-2019-6540

6.5 MEDIUM Published 2019-03-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-03-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
3.3 LOW — AV:A/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-319

Description

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.

Affected configurations

• medtronic mycarelink monitor 24950 firmware • medtronic mycarelink monitor 24952 firmware • medtronic carelink monitor 2490c firmware • medtronic carelink 2090 firmware • medtronic amplia crt-d firmware • medtronic claria crt-d firmware • medtronic compia crt-d firmware • medtronic concerto crt-d firmware • medtronic concerto ii crt-d firmware • medtronic consulta crt-d firmware • medtronic evera icd firmware • medtronic maximo ii crt-d firmware • medtronic maximo ii icd firmware • medtronic mirro icd firmware • medtronic nayamed nd icd firmware • medtronic primo icd firmware • medtronic protecta icd firmware • medtronic protecta crt-d firmware • medtronic secura icd firmware • medtronic virtuoso icd firmware • medtronic virtuoso ii icd firmware • medtronic visia af icd firmware • medtronic viva crt-d firmware

Related

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References