Skip to content
Fencer Intel
medium 6.5

CVE-2019-6540 json

Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information

published 7y ago modified 4mo ago also EUVD-2019-16099

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits
0
none known

Summary

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.

Is CVE-2019-6540 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-19-080-01 updated cvss 6.5

Medtronic Conexus Radio Frequency Telemetry Protocol (Update C)

  • Medtronic Amplia CRT-D Medtronic Brava CRT-D Medtronic CareLink 2090 Programmer Medtronic CareLink Monitor 2490C Medtronic Claria CRT-D Medtronic Compia CRT-D
    +16 more products
    Medtronic Concerto CRT-D Medtronic Concerto II CRT-D Medtronic Consulta CRT-D Medtronic Evera ICD Medtronic Maximo II CRT-D and ICD Medtronic Mirro ICD Medtronic Mirro MRI ICD Medtronic MyCareLink Monitor 24950, 24952 Medtronic Nayamed ND ICD Medtronic Primo ICD Medtronic Protecta ICD and CRT-D Medtronic Secura ICD Medtronic Virtuoso ICD Medtronic Virtuoso II ICD Medtronic Visia AF ICD Medtronic Viva CRT-D
    affected: vendor fix medtronic.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 3.3 AV:A/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Medtronic Conexus Radio Frequency Telemetry Protocol
  • Medtronic MyCareLink Monitor
  • Medtronic CareLink Monitor
  • Medtronic CareLink 2090 Programmer
  • Medtronic Amplia CRT-D
  • Medtronic Claria CRT-D
  • Medtronic Compia CRT-D
  • Medtronic Concerto CRT-D
  • Medtronic Concerto II CRT-D
  • Medtronic Consulta CRT-D
  • Medtronic Evera ICD
  • Medtronic Maximo II CRT-D
  • Medtronic Maximo II ICD
  • Medtronic Mirro ICD
  • Medtronic Nayamed ND ICD
  • Medtronic Primo ICD
  • Medtronic Protecta ICD, Protecta CRT-D
  • Medtronic Secura ICD
  • Medtronic Virtuoso ICD
  • Medtronic Virtuoso II ICD
  • Medtronic Visia AF ICD
  • Medtronic Viva CRT-D
  • Medtronic Brava CRT-D
  • Medtronic Mirro MRI ICD

Classification

Weakness
  • CWE-319 Cleartext Transmission of Sensitive Information

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.