Vulnerability CVE-2019-6540


Published: 2019-03-26

Description:
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.

Type:

CWE-310

(Cryptographic Issues)

CVSS2 => (AV:A/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.3/10
2.9/10
6.5/10
Exploit range
Attack complexity
Authentication
Adjacent network
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Medtronic -> Primo icd firmware 
Medtronic -> Amplia crt-d firmware 
Medtronic -> Protecta crt-d firmware 
Medtronic -> Carelink 2090 firmware 
Medtronic -> Protecta icd firmware 
Medtronic -> Carelink monitor 2490c firmware 
Medtronic -> Secura icd firmware 
Medtronic -> Claria crt-d firmware 
Medtronic -> Virtuoso icd firmware 
Medtronic -> Compia crt-d firmware 
Medtronic -> Virtuoso ii icd firmware 
Medtronic -> Concerto crt-d firmware 
Medtronic -> Visia af icd firmware 
Medtronic -> Concerto ii crt-d firmware 
Medtronic -> Viva crt-d firmware 
Medtronic -> Consulta crt-d firmware 
Medtronic -> Evera icd firmware 
Medtronic -> Maximo ii crt-d firmware 
Medtronic -> Maximo ii icd firmware 
Medtronic -> Mirro icd firmware 
Medtronic -> Mycarelink monitor 24950 firmware 
Medtronic -> Mycarelink monitor 24952 firmware 
Medtronic -> Nayamed nd icd firmware 

 References:
http://www.securityfocus.com/bid/107544
https://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01

Copyright 2022, cxsecurity.com

 

Back to Top