CVE-2019-6538— 多款Medtronic产品访问控制错误漏洞
一分钟漏洞结论
影响对象
Medtronic Conexus Radio Frequency Telemetry Protocol
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
多款Medtronic产品中存在访问控制错误漏洞，该漏洞源于Conexus遥测协议没有执行授权或身份验证。攻击者可利用该漏洞注入，修改或拦截遥测通信中的输入。以下产品和版本受到影响：MyCareLink Monitor 24950版本，24952版本；CareLink Monitor 2490C版本；CareLink 2090 Programmer；Amplia CRT-D；Claria CRT-D；Compia CRT-D；Concerto CRT-D；Concerto II CRT-D；Consult
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2019-6538 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control
来源: CVE Program / CVE List V5
Vulnerability Description
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement authentication or authorization. An attacker with adjacent short-range access to an affected product, in situations where the product’s radio is turned on, can inject, replay, modify, and/or intercept data within the telemetry communication. This communication protocol provides the ability to read and write memory values to affected implanted cardiac devices; therefore, an attacker could exploit this communication protocol to change memory in the implanted cardiac device.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
来源: CVE Program / CVE List V5
Vulnerability Title
多款Medtronic产品访问控制错误漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
多款Medtronic产品中存在访问控制错误漏洞，该漏洞源于Conexus遥测协议没有执行授权或身份验证。攻击者可利用该漏洞注入，修改或拦截遥测通信中的输入。以下产品和版本受到影响：MyCareLink Monitor 24950版本，24952版本；CareLink Monitor 2490C版本；CareLink 2090 Programmer；Amplia CRT-D；Claria CRT-D；Compia CRT-D；Concerto CRT-D；Concerto II CRT-D；Consult
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Medtronic | Conexus Radio Frequency Telemetry Protocol | All versions | - |
|
| Medtronic | MyCareLink Monitor | 24950 | - |
|
| Medtronic | CareLink Monitor | 2490C | - |
|
| Medtronic | CareLink 2090 Programmer | All versions | - |
|
| Medtronic | Amplia CRT-D | All versions | - |
|
| Medtronic | Claria CRT-D | All versions | - |
|
| Medtronic | Compia CRT-D | All versions | - |
|
| Medtronic | Concerto CRT-D | All versions | - |
|
| Medtronic | Concerto II CRT-D | All versions | - |
|
| Medtronic | Consulta CRT-D | All versions | - |
|
| Medtronic | Evera ICD | All versions | - |
|
| Medtronic | Maximo II CRT-D | All versions | - |
|
| Medtronic | Maximo II ICD | All versions | - |
|
| Medtronic | Mirro ICD | All versions | - |
|
| Medtronic | Nayamed ND ICD | All versions | - |
|
| Medtronic | Primo ICD | All versions | - |
|
| Medtronic | Protecta ICD, Protecta CRT-D | All versions | - |
|
| Medtronic | Secura ICD | All versions | - |
|
| Medtronic | Virtuoso ICD | All versions | - |
|
| Medtronic | Virtuoso II ICD | All versions | - |
|
| Medtronic | Visia AF ICD | All versions | - |
|
| Medtronic | Viva CRT-D | All versions | - |
|
| Medtronic | Brava CRT-D | All versions | - |
|
| Medtronic | Mirro MRI ICD | All versions | - |
|
二、漏洞 CVE-2019-6538 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2019-6538 的情报信息
请登录查看更多情报信息。
CVE-2019-6538 厂商安全公告 (1)
CVE-2019-6538 其他参考 (1)
-
https://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01 x_refsource_CONFIRM
IV. Related Vulnerabilities
V. Comments for CVE-2019-6538
暂无评论