{"answers":{"affected":"It affects 23 products.","exploited":"There is no known exploitation of CVE-2019-6540 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2019-6540 yet. Limit exposure of the affected software until one is available.","what":"CVE-2019-6540 is a medium-severity vulnerability in Medtronic Amplia CRT-D, published on 26 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2019-6540 and fix it if it is affected.\n\nWhat it is: CVE-2019-6540 is a medium-severity vulnerability in Medtronic Amplia CRT-D, published on 26 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2019-6540 in the wild and no public exploit code.\n\nAffected product: Medtronic Amplia CRT-D. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2019-6540/ (Markdown: https://insights.sbomify.com/CVE-2019-6540/index.md)","id":"CVE-2019-6540","markdown":"https://insights.sbomify.com/CVE-2019-6540/index.md","name":"CVE-2019-6540","record":{"aliases":["GHSA-r6ff-m2x2-m36p"],"analysis":{"component_type":"ics_ot","fix_type":"no_fix_stated","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Medtronic cardiac devices","requires_auth":"none","summary":"Attackers with short-range access can intercept unencrypted telemetry data from Medtronic cardiac devices, exposing sensitive patient information.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"icscert","cpe":[{"product":"amplia_crt-d_firmware","vendor":"medtronic"},{"product":"carelink_2090_firmware","vendor":"medtronic"},{"product":"carelink_monitor_2490c_firmware","vendor":"medtronic"},{"product":"claria_crt-d_firmware","vendor":"medtronic"},{"product":"compia_crt-d_firmware","vendor":"medtronic"},{"product":"concerto_crt-d_firmware","vendor":"medtronic"},{"product":"concerto_ii_crt-d_firmware","vendor":"medtronic"},{"product":"consulta_crt-d_firmware","vendor":"medtronic"},{"product":"evera_icd_firmware","vendor":"medtronic"},{"product":"maximo_ii_crt-d_firmware","vendor":"medtronic"},{"product":"maximo_ii_icd_firmware","vendor":"medtronic"},{"product":"mirro_icd_firmware","vendor":"medtronic"},{"product":"mycarelink_monitor_24950_firmware","vendor":"medtronic"},{"product":"mycarelink_monitor_24952_firmware","vendor":"medtronic"},{"product":"nayamed_nd_icd_firmware","vendor":"medtronic"},{"product":"primo_icd_firmware","vendor":"medtronic"},{"product":"protecta_crt-d_firmware","vendor":"medtronic"},{"product":"protecta_icd_firmware","vendor":"medtronic"},{"product":"secura_icd_firmware","vendor":"medtronic"},{"product":"virtuoso_icd_firmware","vendor":"medtronic"},{"product":"virtuoso_ii_icd_firmware","vendor":"medtronic"},{"product":"visia_af_icd_firmware","vendor":"medtronic"},{"product":"viva_crt-d_firmware","vendor":"medtronic"}],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-319","name":"Cleartext Transmission of Sensitive Information"}],"description":"The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information","id":"CVE-2019-6540","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2019"},"n_packages":0,"n_references":2,"next":{"headline":"Memory corruption in WECON LeviStudioU","id":"CVE-2019-6541"},"packages":[],"prev":{"headline":"Memory corruption in WECON LeviStudioU","id":"CVE-2019-6539"},"products":["Amplia CRT-D","Brava CRT-D","CareLink 2090 Programmer","CareLink Monitor","Claria CRT-D","Compia CRT-D","Concerto CRT-D","Concerto II CRT-D","Conexus Radio Frequency Telemetry Protocol","Consulta CRT-D","Evera ICD","Maximo II CRT-D","Maximo II ICD","Mirro ICD","Mirro MRI ICD","MyCareLink Monitor","Nayamed ND ICD","Primo ICD","Protecta ICD, Protecta CRT-D","Secura ICD","Virtuoso ICD","Virtuoso II ICD","Visia AF ICD","Viva CRT-D"],"published":"2019-03-26","related":[{"cvss_score":9.3,"headline":"Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control","id":"CVE-2019-6538","kev_date_added":null,"published":"2019-03-25"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2025-05-22","vendors":["Medtronic"]},"summary":"Attackers with short-range access can intercept unencrypted telemetry data from Medtronic cardiac devices, exposing sensitive patient information.","url":"https://insights.sbomify.com/CVE-2019-6540/"}