CVE-2019-6540

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

VendorProductVersions
MedtronicConexus Radio Frequency Telemetry ProtocolAll versions
MedtronicMyCareLink Monitor24950; 24952
MedtronicCareLink Monitor2490C
MedtronicCareLink 2090 ProgrammerAll versions
MedtronicAmplia CRT-DAll versions
MedtronicClaria CRT-DAll versions
MedtronicCompia CRT-DAll versions
MedtronicConcerto CRT-DAll versions
MedtronicConcerto II CRT-DAll versions
MedtronicConsulta CRT-DAll versions
MedtronicEvera ICDAll versions
MedtronicMaximo II CRT-DAll versions
MedtronicMaximo II ICDAll versions
MedtronicMirro ICDAll versions
MedtronicNayamed ND ICDAll versions
MedtronicPrimo ICDAll versions
MedtronicProtecta ICD, Protecta CRT-DAll versions
MedtronicSecura ICDAll versions
MedtronicVirtuoso ICDAll versions
MedtronicVirtuoso II ICDAll versions
MedtronicVisia AF ICDAll versions
MedtronicViva CRT-DAll versions
MedtronicBrava CRT-DAll versions
MedtronicMirro MRI ICDAll versions

References

Timeline

Published
Mar 26, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-65417.8A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code executioCVE-2019-65427.5ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)_update_05032019-482 allows an unauthenticated usCVE-2019-65439.8AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20CVE-2019-65445.6GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an unprivileged user to perform CVE-2019-65457.5AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20CVE-2019-65467.8GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working directory of the program, whiCVE-2019-65475.5Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability may cause the softwCVE-2019-65489.8GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, which may allow control over the CVE-2019-65497.2An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 (or SoftwareCVE-2019-65509.8Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validaCVE-2019-65517.5Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafteCVE-2019-65529.8Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of us
CVE-2019-6540: Medium severity, CVSS 6.5 | Vulnix