CVE-2019-6540Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information
Updated under an hour ago ()
Does this affect you?
It affects Medtronic Conexus Radio Frequency Telemetry Protocol and 46 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.19%, higher than 9% of scored CVEs.
Do this next
Free account, 1 product
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-319
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.19% (percentile 9)
- Assigned by
- icscert
- NVD analysis
- Modified
- Record last updated
- May 22, 2025
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
Medtronic Conexus Radio Frequency Telemetry Protocol medtronic:conexus_radio_frequency_telemetry_protocol (from the name) | all versions | CNA record |
Medtronic MyCareLink Monitor medtronic:mycarelink_monitor (from the name) | 24950; 24952 | CNA record |
Medtronic CareLink Monitor medtronic:carelink_monitor (from the name) | 2490C | CNA record |
Medtronic CareLink 2090 Programmer medtronic:carelink_2090_programmer (from the name) | all versions | CNA record |
Medtronic Amplia CRT-D medtronic:amplia_crt_d (from the name) | all versions | CNA record |
Medtronic Claria CRT-D medtronic:claria_crt_d (from the name) | all versions | CNA record |
Medtronic Compia CRT-D medtronic:compia_crt_d (from the name) | all versions | CNA record |
Medtronic Concerto CRT-D medtronic:concerto_crt_d (from the name) | all versions | CNA record |
Medtronic Concerto II CRT-D medtronic:concerto_ii_crt_d (from the name) | all versions | CNA record |
Medtronic Consulta CRT-D medtronic:consulta_crt_d (from the name) | all versions | CNA record |
Medtronic Evera ICD medtronic:evera_icd (from the name) | all versions | CNA record |
Medtronic Maximo II CRT-D medtronic:maximo_ii_crt_d (from the name) | all versions | CNA record |
Medtronic Maximo II ICD medtronic:maximo_ii_icd (from the name) | all versions | CNA record |
Medtronic Mirro ICD medtronic:mirro_icd (from the name) | all versions | CNA record |
Medtronic Nayamed ND ICD medtronic:nayamed_nd_icd (from the name) | all versions | CNA record |
Medtronic Primo ICD medtronic:primo_icd (from the name) | all versions | CNA record |
Medtronic Protecta ICD, Protecta CRT-D medtronic:protecta_icd_protecta_crt_d (from the name) | all versions | CNA record |
Medtronic Secura ICD medtronic:secura_icd (from the name) | all versions | CNA record |
Medtronic Virtuoso ICD medtronic:virtuoso_icd (from the name) | all versions | CNA record |
Medtronic Virtuoso II ICD medtronic:virtuoso_ii_icd (from the name) | all versions | CNA record |
Medtronic Visia AF ICD medtronic:visia_af_icd (from the name) | all versions | CNA record |
Medtronic Viva CRT-D medtronic:viva_crt_d (from the name) | all versions | CNA record |
Medtronic Brava CRT-D medtronic:brava_crt_d (from the name) | all versions | CNA record |
Medtronic Mirro MRI ICD medtronic:mirro_mri_icd (from the name) | all versions | CNA record |
medtronic mycarelink_monitor_24950_firmware medtronic:mycarelink_monitor_24950_firmware | all versions | NVD |
medtronic mycarelink_monitor_24952_firmware medtronic:mycarelink_monitor_24952_firmware | all versions | NVD |
medtronic carelink_monitor_2490c_firmware medtronic:carelink_monitor_2490c_firmware | all versions | NVD |
medtronic carelink_2090_firmware medtronic:carelink_2090_firmware | all versions | NVD |
medtronic amplia_crt-d_firmware medtronic:amplia_crt-d_firmware | all versions | NVD |
medtronic claria_crt-d_firmware medtronic:claria_crt-d_firmware | all versions | NVD |
medtronic compia_crt-d_firmware medtronic:compia_crt-d_firmware | all versions | NVD |
medtronic concerto_crt-d_firmware medtronic:concerto_crt-d_firmware | all versions | NVD |
medtronic concerto_ii_crt-d_firmware medtronic:concerto_ii_crt-d_firmware | all versions | NVD |
medtronic consulta_crt-d_firmware medtronic:consulta_crt-d_firmware | all versions | NVD |
medtronic evera_icd_firmware medtronic:evera_icd_firmware | all versions | NVD |
medtronic maximo_ii_crt-d_firmware medtronic:maximo_ii_crt-d_firmware | all versions | NVD |
medtronic maximo_ii_icd_firmware medtronic:maximo_ii_icd_firmware | all versions | NVD |
medtronic mirro_icd_firmware medtronic:mirro_icd_firmware | all versions | NVD |
medtronic nayamed_nd_icd_firmware medtronic:nayamed_nd_icd_firmware | all versions | NVD |
medtronic primo_icd_firmware medtronic:primo_icd_firmware | all versions | NVD |
medtronic protecta_icd_firmware medtronic:protecta_icd_firmware | all versions | NVD |
medtronic protecta_crt-d_firmware medtronic:protecta_crt-d_firmware | all versions | NVD |
medtronic secura_icd_firmware medtronic:secura_icd_firmware | all versions | NVD |
medtronic virtuoso_icd_firmware medtronic:virtuoso_icd_firmware | all versions | NVD |
medtronic virtuoso_ii_icd_firmware medtronic:virtuoso_ii_icd_firmware | all versions | NVD |
medtronic visia_af_icd_firmware medtronic:visia_af_icd_firmware | all versions | NVD |
medtronic viva_crt-d_firmware medtronic:viva_crt-d_firmware | all versions | NVD |
References
- https://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01x-refsource-misc, third-party-advisory, us-government-resource
- http://www.securityfocus.com/bid/107544vdb-entry, x-refsource-bid, broken-link
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.