Vulnerability CVE-2019-6538

Published: 2019-03-25   Modified: 2019-03-26

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement authentication or authorization. An attacker with adjacent short-range access to an affected product, in situations where the product?s radio is turned on, can inject, replay, modify, and/or intercept data within the telemetry communication. This communication protocol provides the ability to read and write memory values to affected implanted cardiac devices; therefore, an attacker could exploit this communication protocol to change memory in the implanted cardiac device.



(Improper Access Control)

CVSS2 => (AV:A/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
Exploit range
Attack complexity
Adjacent network
No required
Confidentiality impact
Integrity impact
Availability impact
Affected software
Medtronic -> Secura icd firmware 
Medtronic -> Amplia crt-d firmware 
Medtronic -> Virtuoso icd firmware 
Medtronic -> Carelink 2090 firmware 
Medtronic -> Virtuoso ii icd firmware 
Medtronic -> Carelink monitor firmware 
Medtronic -> Visia af icd firmware 
Medtronic -> Claria crt-d firmware 
Medtronic -> Viva crt-d firmware 
Medtronic -> Compia crt-d firmware 
Medtronic -> Concerto crt-d firmware 
Medtronic -> Concerto ii crt-d firmware 
Medtronic -> Consulta crt-d firmware 
Medtronic -> Evera icd firmware 
Medtronic -> Maximo ii crt-d and lcd firmware 
Medtronic -> Mirro icd firmware 
Medtronic -> Mycarelink monitor firmware 
Medtronic -> Nayamed nd icd firmware 
Medtronic -> Primo icd firmware 
Medtronic -> Protecta icd and crt-d firmware 


Copyright 2022,


Back to Top