What is the CVSS score of CVE-2019-6540?

CVE-2019-6540 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Mycarelink Monitor 24950 Firmware CVE-2019-6540

MEDIUM

Cleartext Transmission of Sensitive Information (CWE-319)

2019-03-26 ics-cert@hq.dhs.gov

Information Disclosure Mycarelink Monitor 24950 Firmware Mycarelink Monitor 24952 Firmware Carelink Monitor 2490C Firmware Carelink 2090 Firmware Amplia Crt D Firmware Claria Crt D Firmware Compia Crt D Firmware Concerto Crt D Firmware Concerto Ii Crt D Firmware Consulta Crt D Firmware Evera Icd Firmware Maximo Ii Crt D Firmware Maximo Ii Icd Firmware Mirro Icd Firmware Nayamed Nd Icd Firmware Primo Icd Firmware Protecta Icd Firmware Protecta Crt D Firmware Secura Icd Firmware Virtuoso Icd Firmware Virtuoso Ii Icd Firmware Visia Af Icd Firmware Viva Crt D Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Mar 26, 2019 - 18:29 nvd

MEDIUM 6.5

DescriptionNVD

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.

AnalysisAI

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-319. The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data. Affected products include: Medtronic Mycarelink Monitor 24950 Firmware, Medtronic Mycarelink Monitor 24952 Firmware, Medtronic Carelink Monitor 2490C Firmware, Medtronic Carelink 2090 Firmware, Medtronic Amplia Crt-D Firmware. Version information: version 2490.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.