Podatność CVE-2019-6538


Publikacja: 2019-03-25   Modyfikacja: 2019-03-26

Opis:
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement authentication or authorization. An attacker with adjacent short-range access to an affected product, in situations where the product?s radio is turned on, can inject, replay, modify, and/or intercept data within the telemetry communication. This communication protocol provides the ability to read and write memory values to affected implanted cardiac devices; therefore, an attacker could exploit this communication protocol to change memory in the implanted cardiac device.

Typ:

CWE-284

(Improper Access Control)

CVSS2 => (AV:A/AC:L/Au:N/C:N/I:P/A:N)

Ogólna skala CVSS
Znaczenie
Łatwość wykorzystania
3.3/10
2.9/10
6.5/10
Wymagany dostęp
Złożoność ataku
Autoryzacja
Sieć lokalna
Niska
Nie wymagana
Wpływ na poufność
Wpływ na integralność
Wpływ na dostępność
Brak
Częściowy
Brak
Affected software
Medtronic -> Secura icd firmware 
Medtronic -> Amplia crt-d firmware 
Medtronic -> Virtuoso icd firmware 
Medtronic -> Carelink 2090 firmware 
Medtronic -> Virtuoso ii icd firmware 
Medtronic -> Carelink monitor firmware 
Medtronic -> Visia af icd firmware 
Medtronic -> Claria crt-d firmware 
Medtronic -> Viva crt-d firmware 
Medtronic -> Compia crt-d firmware 
Medtronic -> Concerto crt-d firmware 
Medtronic -> Concerto ii crt-d firmware 
Medtronic -> Consulta crt-d firmware 
Medtronic -> Evera icd firmware 
Medtronic -> Maximo ii crt-d and lcd firmware 
Medtronic -> Mirro icd firmware 
Medtronic -> Mycarelink monitor firmware 
Medtronic -> Nayamed nd icd firmware 
Medtronic -> Primo icd firmware 
Medtronic -> Protecta icd and crt-d firmware 

 Referencje:
http://www.securityfocus.com/bid/107544
https://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01

Copyright 2022, cxsecurity.com

 

Back to Top