CVE-2019-13535 Medtronic Valleylab FT10 and LS10 Protection Mechanism Failure
Attackers can read RFID security data due to missing read protection in Medtronic Valleylab energy platforms, exposing sensitive device information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13535?
CVE-2019-13535 is a medium-severity missing authorization vulnerability in Medtronic Valleylab FT10 Energy Platform (VLFT10GEN), published on 8 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism does not apply read protection, allowing for full read access of the RFID security mechanism data.
Which versions are affected by CVE-2019-13535?
It affects 2 products.
Products include Medtronic Valleylab Ft10 Energy Platform Firmware, Medtronic Valleylab Ls10 Energy Platform Firmware.
How do I fix CVE-2019-13535?
No fix has been published for CVE-2019-13535 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-13535 being exploited?
There is no known exploitation of CVE-2019-13535 in the wild and no public exploit code.
Other vulnerabilities in Medtronic Valleylab FT10 Energy Platform (VLFT10GEN)
Sources
Also known as GHSA-pqmr-7wg9-jg7r.