Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.2%
exploitation probability
0.2%top 90% of all CVEs
observed exploitation
nono source reports it
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Medtronic · Amplia CRT-DMedtronic · Brava CRT-DMedtronic · CareLink 2090 ProgrammerMedtronic · CareLink MonitorMedtronic · Claria CRT-DMedtronic · Compia CRT-DMedtronic · Concerto CRT-DMedtronic · Concerto II CRT-DMedtronic · Conexus Radio Frequency Telemetry ProtocolMedtronic · Consulta CRT-DMedtronic · Evera ICDMedtronic · Maximo II CRT-DMedtronic · Maximo II ICDMedtronic · Mirro ICDMedtronic · Mirro MRI ICDMedtronic · MyCareLink MonitorMedtronic · Nayamed ND ICDMedtronic · Primo ICDMedtronic · Protecta ICD, Protecta CRT-DMedtronic · Secura ICDMedtronic · Virtuoso ICDMedtronic · Virtuoso II ICDMedtronic · Visia AF ICDMedtronic · Viva CRT-D