02 Records
FEED: ACQUIRING
01 RecordSTATE: PUBLISHED
02 Description
CNA: icscertMedtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control
03 Exploitation and scoring
SRC: CISA, FIRST, NVD, RED HAT- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.90% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Ranks above 57.0% of scored records. A rank, not a probability.
- NVD base score
- 6.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
SCHEMA: 5.1
- Published
- 2019-03-25 21:26Z7 YR AGO
- Last updated
- 2025-05-22 19:26Z1 YR AGO
- Reserved
- 2019-01-22
- Assigning CNA
- icscert
- Record state
- PUBLISHED
- Severity
- Critical (CVSS 9.3)
- CNA CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
- Weaknesses
- CWE-284Improper Access ControlPillar
- CWE-306Missing Authentication for Critical FunctionBase
- CWE-862Missing AuthorizationClass
- Data version
- 5.1
- Document digest
- ff31e780db6e7bf1bdb5e8b064a1739b3b85388692cab3ba96ee87407701bd19
05 Affected products
PAIRS: 24VendorProductVersionsPlatforms
SRC: CNA
Medtronic has developed mitigating patches for a subset of the
affected implanted cardiac device models. These patches are installed
during regular office visits. Medtronic has stated that patches for
additional impacted models are being developed by Medtronic and will be
deployed through future updates. Patches are currently available for the
following affected models:
* Protecta CRT-D and implantable cardioverter defibrillators (ICDs), all models
* Amplia MRI CRT-D, all models (patch available in U.S. only)
* Claria MRI CRT-D, all models (patch available in U.S. only)
* Compia MRI CRT-D, all models (patch available in U.S. only)
* Visia AF MRI ICD, all models
* Visia AF ICD, all models
* Brava CRT-D, all models
* Evera MRI ICD, all models
* Evera ICD, all models
* Mirro MRI ICD, all models
* Primo MRI ICD, all models
* Viva CRT-D, all models