PT-2019-18150 · Medtronic · Claria Crt-D+17
Peter Morgan
·
Published
2019-03-25
·
Updated
2020-10-06
·
CVE-2019-6538
CVSS v3.1
9.3
Critical
| Vector | AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Medtronic MyCareLink Monitor versions 24950 through 24952
CareLink Monitor version 2490C
CareLink 2090 Programmer
Amplia CRT-D
Claria CRT-D
Compia CRT-D
Concerto CRT-D
Concerto II CRT-D
Consulta CRT-D
Evera ICD
Maximo II CRT-D and ICD
Mirro ICD
Nayamed ND ICD
Primo ICD
Protecta ICD and CRT-D
Secura ICD
Virtuoso ICD
Virtuoso II ICD
Visia AF ICD
Viva CRT-D
Description
The Conexus telemetry protocol used in the affected products does not implement authentication or authorization. An attacker with adjacent short-range access to an affected product can inject, replay, modify, and/or intercept data within the telemetry communication when the product's radio is turned on. This allows an attacker to read and write memory values to affected implanted cardiac devices, potentially changing memory in the implanted cardiac device.
Recommendations
For Medtronic MyCareLink Monitor versions 24950 through 24952, consider disabling the Conexus telemetry protocol until a patch is available.
For CareLink Monitor version 2490C, restrict access to the device when not in use to minimize the risk of exploitation.
For all other affected devices, avoid using the telemetry communication feature until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Authentication
Improper Access Control
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Amplia Crt-D
Carelink 2090 Programmer
Carelink Monitor
Claria Crt-D
Compia Crt-D
Concerto Ii Crt-D
Consulta Crt-D
Evera Icd
Maximo Ii Crt-D/Icd
Medtronic Mycarelink Monitor
Mirro Icd
Nayamed Nd Icd
Primo Icd
Protecta Icd/Crt-D
Secura Icd
Virtuoso Icd
Visia Af Icd
Viva Crt-D