CVE-2019-13531 Medtronic Valleylab FT10 and LS10 Improper Authentication
Attackers can bypass RFID authentication to connect unauthorized instruments to Medtronic Valleylab energy platforms, compromising device integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13531?
CVE-2019-13531 is a medium-severity authentication bypass vulnerability in Medtronic Valleylab FT10 Energy Platform (VLFT10GEN), published on 8 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments can be bypassed, allowing for inauthentic instruments to connect to the generator.
Weakness: CWE-287
Which versions are affected by CVE-2019-13531?
It affects 2 products.
Products include Medtronic Valleylab Ft10 Energy Platform Firmware, Medtronic Valleylab Ls10 Energy Platform Firmware.
How do I fix CVE-2019-13531?
No fix has been published for CVE-2019-13531 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-13531 being exploited?
There is no known exploitation of CVE-2019-13531 in the wild and no public exploit code.
Other vulnerabilities in Medtronic Valleylab FT10 Energy Platform (VLFT10GEN)
Sources
Also known as GHSA-jp54-39p3-825v.