CVE-2019-13531mediumCWE-287

CVE-2019-13531: medium-severity vulnerability in Medtronic Valleylab FT10 Energy Platform…

Medtronic Valleylab FT10 and LS10 Improper Authentication

Published · Updated

Follow this CVE+ Monitor Valleylab FT10 Energy Platform+ Monitor Valleylab LS10 Energy Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.4%
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments can be bypassed, allowing for inauthentic instruments to connect to the generator.
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Affected products
Medtronic · Valleylab FT10 Energy Platform (VLFT10GEN)Medtronic · Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States)
Related CVEs — Medtronic Valleylab FT10 Energy Platform…

In the same product, most dangerous first.

CVE-2019-13543MEDIUMMedtronic Valleylab FT10 and FX8 Use of Hard-coded CredentialsEPSS 2.0%CVE-2019-13535MEDIUMMedtronic Valleylab FT10 and LS10 Protection Mechanism FailureEPSS 0.4%CVE-2019-13539HIGHMedtronic Valleylab FT10 and FX8 Reversible One-way HashEPSS 0.3%