CVE-2019-6540

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
References
Link Resource
http://www.securityfocus.com/bid/107544 Broken Link
https://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01 US Government Resource Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:medtronic:mycarelink_monitor_24950_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:mycarelink_monitor_24950:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:medtronic:mycarelink_monitor_24952_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:mycarelink_monitor_24952:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:medtronic:carelink_monitor_2490c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:carelink_monitor_2490c:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:medtronic:carelink_2090_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:carelink_2090:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:medtronic:amplia_crt-d_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:amplia_crt-d:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:medtronic:claria_crt-d_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:claria_crt-d:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:medtronic:compia_crt-d_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:compia_crt-d:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:medtronic:concerto_crt-d_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:concerto_crt-d:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:medtronic:concerto_ii_crt-d_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:concerto_ii_crt-d:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:medtronic:consulta_crt-d_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:consulta_crt-d:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:medtronic:evera_icd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:evera_icd:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:medtronic:maximo_ii_crt-d_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:maximo_ii_crt-d:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:medtronic:maximo_ii_icd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:maximo_ii_icd:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:medtronic:mirro_icd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:mirro_icd:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:medtronic:nayamed_nd_icd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:nayamed_nd_icd:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:medtronic:primo_icd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:primo_icd:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:medtronic:protecta_icd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:protecta_icd:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:medtronic:protecta_crt-d_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:protecta_crt-d:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:medtronic:secura_icd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:secura_icd:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:medtronic:virtuoso_icd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:virtuoso_icd:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:medtronic:virtuoso_ii_icd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:virtuoso_ii_icd:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:medtronic:visia_af_icd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:visia_af_icd:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:medtronic:viva_crt-d_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:medtronic:viva_crt-d:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-03-26 18:29

Updated : 2024-02-28 17:08


NVD link : CVE-2019-6540

Mitre link : CVE-2019-6540

CVE.ORG link : CVE-2019-6540


JSON object : View

Products Affected

medtronic

  • nayamed_nd_icd_firmware
  • secura_icd
  • concerto_crt-d
  • consulta_crt-d
  • evera_icd_firmware
  • protecta_crt-d
  • amplia_crt-d_firmware
  • secura_icd_firmware
  • amplia_crt-d
  • maximo_ii_crt-d_firmware
  • maximo_ii_icd_firmware
  • viva_crt-d
  • compia_crt-d_firmware
  • mycarelink_monitor_24952
  • protecta_icd_firmware
  • claria_crt-d_firmware
  • consulta_crt-d_firmware
  • virtuoso_ii_icd_firmware
  • protecta_icd
  • primo_icd
  • mirro_icd
  • virtuoso_icd
  • viva_crt-d_firmware
  • carelink_2090_firmware
  • primo_icd_firmware
  • claria_crt-d
  • protecta_crt-d_firmware
  • virtuoso_ii_icd
  • visia_af_icd_firmware
  • carelink_monitor_2490c
  • carelink_monitor_2490c_firmware
  • concerto_ii_crt-d_firmware
  • mycarelink_monitor_24950_firmware
  • maximo_ii_crt-d
  • mirro_icd_firmware
  • nayamed_nd_icd
  • compia_crt-d
  • mycarelink_monitor_24950
  • visia_af_icd
  • virtuoso_icd_firmware
  • evera_icd
  • maximo_ii_icd
  • concerto_ii_crt-d
  • mycarelink_monitor_24952_firmware
  • carelink_2090
  • concerto_crt-d_firmware
CWE
CWE-319

Cleartext Transmission of Sensitive Information