CVE-2019-6540
Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
- Record
CVE-2019-6540- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
EUVDEUVD-2019-16099
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
- Record
EUVD-2019-16099- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r6ff-m2x2-m36p
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and...
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
- Record
GHSA-r6ff-m2x2-m36p- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
NVD
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
- Record
CVE-2019-6540- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 3.3 Low
AV:A/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
Affected products
- medtronic amplia crt-d
- medtronic carelink 2090 programmer
- medtronic carelink monitor
- medtronic claria crt-d
- medtronic compia crt-d
- medtronic concerto crt-d
- medtronic concerto ii crt-d
- medtronic conexus radio frequency telemetry protocol
- medtronic consulta crt-d
- medtronic evera icd
- medtronic maximo ii crt-d
- medtronic mirro icd
Show 35 moreShow less
- medtronic mycarelink monitor
- medtronic nayamed nd icd
- medtronic primo icd
- medtronic secura icd
- medtronic virtuoso icd
- medtronic virtuoso ii icd
- medtronic visia af icd
- medtronic viva crt-d
- medtronic amplia crt-d firmware
- medtronic brava crt-d
- medtronic carelink 2090 firmware
- medtronic carelink monitor 2490c firmware
- medtronic claria crt-d firmware
- medtronic compia crt-d firmware
- medtronic concerto crt-d firmware
- medtronic concerto ii crt-d firmware
- medtronic consulta crt-d firmware
- medtronic evera icd firmware
- medtronic maximo ii icd
- medtronic maximo ii crt-d firmware
- medtronic maximo ii icd firmware
- medtronic mirro mri icd
- medtronic mirro icd firmware
- medtronic mycarelink monitor 24950 firmware
- medtronic mycarelink monitor 24952 firmware
- medtronic nayamed nd icd firmware
- medtronic primo icd firmware
- medtronic protecta icd, protecta crt-d
- medtronic protecta crt-d firmware
- medtronic protecta icd firmware
- medtronic secura icd firmware
- medtronic virtuoso icd firmware
- medtronic virtuoso ii icd firmware
- medtronic visia af icd firmware
- medtronic viva crt-d firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-6540 is a medium vulnerability (CVSS 6.5) in Medtronic Amplia Crt-d, published March 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. No source names a fixed version.