Medium severity6.5NVD Advisory· Published Mar 26, 2019· Updated Jun 17, 2026

CVE-2019-6540

Description

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Medtronic/Amplia Crt D Firmware
cpe:2.3:o:medtronic:amplia_crt-d_firmware:-:*:*:*:*:*:*:*
Medtronic/Carelink 2090 Firmware
cpe:2.3:o:medtronic:carelink_2090_firmware:-:*:*:*:*:*:*:*
Medtronic/Carelink Monitor 2490c Firmware
cpe:2.3:o:medtronic:carelink_monitor_2490c_firmware:-:*:*:*:*:*:*:*
Medtronic/Claria Crt D Firmware
cpe:2.3:o:medtronic:claria_crt-d_firmware:-:*:*:*:*:*:*:*
Medtronic/Compia Crt D Firmware
cpe:2.3:o:medtronic:compia_crt-d_firmware:-:*:*:*:*:*:*:*
Medtronic/Concerto Crt D Firmware
cpe:2.3:o:medtronic:concerto_crt-d_firmware:-:*:*:*:*:*:*:*
Medtronic/Concerto Ii Crt D Firmware
cpe:2.3:o:medtronic:concerto_ii_crt-d_firmware:-:*:*:*:*:*:*:*
Medtronic/Consulta Crt D Firmware
cpe:2.3:o:medtronic:consulta_crt-d_firmware:-:*:*:*:*:*:*:*
Medtronic/Evera Icd Firmware
cpe:2.3:o:medtronic:evera_icd_firmware:-:*:*:*:*:*:*:*
Medtronic/Maximo Ii Crt D Firmware
cpe:2.3:o:medtronic:maximo_ii_crt-d_firmware:-:*:*:*:*:*:*:*
Medtronic/Maximo Ii Icd Firmware
cpe:2.3:o:medtronic:maximo_ii_icd_firmware:-:*:*:*:*:*:*:*
Medtronic/Mirro Icd Firmware
cpe:2.3:o:medtronic:mirro_icd_firmware:-:*:*:*:*:*:*:*
Medtronic/Mycarelink Monitor 24950 Firmware
cpe:2.3:o:medtronic:mycarelink_monitor_24950_firmware:-:*:*:*:*:*:*:*
Medtronic/Mycarelink Monitor 24952 Firmware
cpe:2.3:o:medtronic:mycarelink_monitor_24952_firmware:-:*:*:*:*:*:*:*
Medtronic/Nayamed Nd Icd Firmware
cpe:2.3:o:medtronic:nayamed_nd_icd_firmware:-:*:*:*:*:*:*:*
Medtronic/Primo Icd Firmware
cpe:2.3:o:medtronic:primo_icd_firmware:-:*:*:*:*:*:*:*
Medtronic/Protecta Crt D Firmware
cpe:2.3:o:medtronic:protecta_crt-d_firmware:-:*:*:*:*:*:*:*
Medtronic/Protecta Icd Firmware
cpe:2.3:o:medtronic:protecta_icd_firmware:-:*:*:*:*:*:*:*
Medtronic/Secura Icd Firmware
cpe:2.3:o:medtronic:secura_icd_firmware:-:*:*:*:*:*:*:*
Medtronic/Virtuoso Icd Firmware
cpe:2.3:o:medtronic:virtuoso_icd_firmware:-:*:*:*:*:*:*:*
Medtronic/Virtuoso Ii Icd Firmware
cpe:2.3:o:medtronic:virtuoso_ii_icd_firmware:-:*:*:*:*:*:*:*
Medtronic/Visia Af Icd Firmware
cpe:2.3:o:medtronic:visia_af_icd_firmware:-:*:*:*:*:*:*:*
Medtronic/Viva Crt D Firmware
cpe:2.3:o:medtronic:viva_crt-d_firmware:-:*:*:*:*:*:*:*
Medtronic/Amplia CRT-Dllm-create
Medtronic/CareLink 2090 Programmerllm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: All versions
Medtronic/CareLink Monitorllm-fuzzy2 versions
24950, 24952+ 1 more
- (no CPE)range: 24950, 24952
- (no CPE)range: 2490C
Medtronic/Amplia CRT-Dv5
Range: All versions
Medtronic/Brava CRT-Dv5
Range: All versions
Medtronic/Claria CRT-Dv5
Range: All versions
Medtronic/Compia CRT-Dv5
Range: All versions
Medtronic/Concerto CRT-Dv5
Range: All versions
Medtronic/Concerto II CRT-Dv5
Range: All versions
Medtronic/Conexus Radio Frequency Telemetry Protocolv5
Range: All versions
Medtronic/Consulta CRT-Dv5
Range: All versions
Medtronic/Evera ICDv5
Range: All versions
Medtronic/Maximo II CRT-Dv5
Range: All versions
Medtronic/Maximo II ICDv5
Range: All versions
Medtronic/Mirro ICDv5
Range: All versions
Medtronic/Mirro MRI ICDv5
Range: All versions
Medtronic/MyCareLink Patient Monitorcpe-rescue
Range: 24950
Medtronic/Nayamed ND ICDv5
Range: All versions
Medtronic/Primo ICDv5
Range: All versions
Medtronic/Protecta ICD, Protecta CRT-Dv5
Range: All versions
Medtronic/Secura ICDv5
Range: All versions
Medtronic/Virtuoso ICDv5
Range: All versions
Medtronic/Virtuoso II ICDv5
Range: All versions
Medtronic/Visia AF ICDv5
Range: All versions
Medtronic/Viva CRT-Dv5
Range: All versions

Patches

Vulnerability mechanics

References

ics-cert.us-cert.gov/advisories/ICSMA-19-080-01nvdThird Party AdvisoryUS Government Resource
www.securityfocus.com/bid/107544nvdBroken Link

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.5/ 10

Attack vector: Adjacent
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

Probability of exploitation in the next 30 days.

0.20%

VYPR risk score

Composite of severity, exploitation, and reach.

0.42medium

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-319
Cleartext Transmission of Sensitive Information

CVE ID

CVE-2019-6540

Credits

PM
Peter Morgan of Clever Security; Dave Singelée and Bart Preneel of KU Leuven; Eduard Marin formerly of KU Leuven, currently with University of Birmingham; Flavio D. Garcia; Tom Chothia of the University of Birmingham; and Rik Willems of University Hospital Gasthuisberg Leuven reported these vulnerabilities to CISA.
finder