Vulnerability CVE-2019-6538


Published: 2019-03-25   Modified: 2019-03-26

Description:
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement authentication or authorization. An attacker with adjacent short-range access to an affected product, in situations where the product?s radio is turned on, can inject, replay, modify, and/or intercept data within the telemetry communication. This communication protocol provides the ability to read and write memory values to affected implanted cardiac devices; therefore, an attacker could exploit this communication protocol to change memory in the implanted cardiac device.

Type:

CWE-284

(Improper Access Control)

CVSS2 => (AV:A/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.3/10
2.9/10
6.5/10
Exploit range
Attack complexity
Authentication
Adjacent network
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Medtronic -> Secura icd firmware 
Medtronic -> Amplia crt-d firmware 
Medtronic -> Virtuoso icd firmware 
Medtronic -> Carelink 2090 firmware 
Medtronic -> Virtuoso ii icd firmware 
Medtronic -> Carelink monitor firmware 
Medtronic -> Visia af icd firmware 
Medtronic -> Claria crt-d firmware 
Medtronic -> Viva crt-d firmware 
Medtronic -> Compia crt-d firmware 
Medtronic -> Concerto crt-d firmware 
Medtronic -> Concerto ii crt-d firmware 
Medtronic -> Consulta crt-d firmware 
Medtronic -> Evera icd firmware 
Medtronic -> Maximo ii crt-d and lcd firmware 
Medtronic -> Mirro icd firmware 
Medtronic -> Mycarelink monitor firmware 
Medtronic -> Nayamed nd icd firmware 
Medtronic -> Primo icd firmware 
Medtronic -> Protecta icd and crt-d firmware 

 References:
http://www.securityfocus.com/bid/107544
https://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01

Copyright 2022, cxsecurity.com

 

Back to Top