CVE-2019-6538
Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control
02 Description
Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.89% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 59.1% of scored records. A rank, not a probability.
- NVD base score
- 6.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2019-03-25 21:26Z7 YR AGO
- Last updated
- 2025-05-22 19:26Z1 YR AGO
- Reserved
- 2019-01-22
- Assigning CNA
- icscert
- Record state
- PUBLISHED
- Severity
- Critical (CVSS 9.3)
- CNA CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
- Weaknesses
- Data version
- 5.1
- Document digest
- ff31e780db6e7bf1bdb5e8b064a1739b3b85388692cab3ba96ee87407701bd19
05 Affected products
06 References
- ics-cert.us-cert.govhttps://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01
- www.securityfocus.com107544http://www.securityfocus.com/bid/107544
07 Remediation
Medtronic has developed mitigating patches for a subset of the affected implanted cardiac device models. These patches are installed during regular office visits. Medtronic has stated that patches for additional impacted models are being developed by Medtronic and will be deployed through future updates. Patches are currently available for the following affected models: * Protecta CRT-D and implantable cardioverter defibrillators (ICDs), all models * Amplia MRI CRT-D, all models (patch available in U.S. only) * Claria MRI CRT-D, all models (patch available in U.S. only) * Compia MRI CRT-D, all models (patch available in U.S. only) * Visia AF MRI ICD, all models * Visia AF ICD, all models * Brava CRT-D, all models * Evera MRI ICD, all models * Evera ICD, all models * Mirro MRI ICD, all models * Primo MRI ICD, all models * Viva CRT-D, all models