CVE-2019-6540
Description
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| medtronic mycarelink_monitor_24950_firmware | No range specified | — |
| medtronic mycarelink_monitor_24952_firmware | No range specified | — |
| medtronic carelink_monitor_2490c_firmware | No range specified | — |
| medtronic carelink_2090_firmware | No range specified | — |
| medtronic amplia_crt-d_firmware | No range specified | — |
| medtronic claria_crt-d_firmware | No range specified | — |
| medtronic compia_crt-d_firmware | No range specified | — |
| medtronic concerto_crt-d_firmware | No range specified | — |
| medtronic concerto_ii_crt-d_firmware | No range specified | — |
| medtronic consulta_crt-d_firmware | No range specified | — |
| medtronic evera_icd_firmware | No range specified | — |
| medtronic maximo_ii_crt-d_firmware | No range specified | — |
| medtronic maximo_ii_icd_firmware | No range specified | — |
| medtronic mirro_icd_firmware | No range specified | — |
| medtronic nayamed_nd_icd_firmware | No range specified | — |
| medtronic primo_icd_firmware | No range specified | — |
| medtronic protecta_icd_firmware | No range specified | — |
| medtronic protecta_crt-d_firmware | No range specified | — |
| medtronic secura_icd_firmware | No range specified | — |
| medtronic virtuoso_icd_firmware | No range specified | — |
| medtronic virtuoso_ii_icd_firmware | No range specified | — |
| medtronic visia_af_icd_firmware | No range specified | — |
| medtronic viva_crt-d_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.