Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information
Priority LOW 28CWE-319Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.
Summary
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
Why it matters now
EPSS 0.00195 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Medtronic | Conexus Radio Frequency Telemetry Protocol | All versions | — | No fix listed | CNA |
| Medtronic | MyCareLink Monitor | 24950; 24952 | — | No fix listed | CNA |
| Medtronic | CareLink Monitor | 2490C | — | No fix listed | CNA |
| Medtronic | CareLink 2090 Programmer | All versions | — | No fix listed | CNA |
| Medtronic | Amplia CRT-D | All versions | — | No fix listed | CNA |
| Medtronic | Claria CRT-D | All versions | — | No fix listed | CNA |
| Medtronic | Compia CRT-D | All versions | — | No fix listed | CNA |
| Medtronic | Concerto CRT-D | All versions | — | No fix listed | CNA |
| Medtronic | Concerto II CRT-D | All versions | — | No fix listed | CNA |
| Medtronic | Consulta CRT-D | All versions | — | No fix listed | CNA |
| Medtronic | Evera ICD | All versions | — | No fix listed | CNA |
| Medtronic | Maximo II CRT-D | All versions | — | No fix listed | CNA |
| Medtronic | Maximo II ICD | All versions | — | No fix listed | CNA |
| Medtronic | Mirro ICD | All versions | — | No fix listed | CNA |
| Medtronic | Nayamed ND ICD | All versions | — | No fix listed | CNA |
| Medtronic | Primo ICD | All versions | — | No fix listed | CNA |
| Medtronic | Protecta ICD, Protecta CRT-D | All versions | — | No fix listed | CNA |
| Medtronic | Secura ICD | All versions | — | No fix listed | CNA |
| Medtronic | Virtuoso ICD | All versions | — | No fix listed | CNA |
| Medtronic | Virtuoso II ICD | All versions | — | No fix listed | CNA |
| Medtronic | Visia AF ICD | All versions | — | No fix listed | CNA |
| Medtronic | Viva CRT-D | All versions | — | No fix listed | CNA |
| Medtronic | Brava CRT-D | All versions | — | No fix listed | CNA |
| Medtronic | Mirro MRI ICD | All versions | — | No fix listed | CNA |
- Conexus Radio Frequency Telemetry Protocol VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- MyCareLink Monitor VendorMedtronic Affected 24950; 24952 Fixed in — No fix listed CNA
- CareLink Monitor VendorMedtronic Affected 2490C Fixed in — No fix listed CNA
- CareLink 2090 Programmer VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Amplia CRT-D VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Claria CRT-D VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Compia CRT-D VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Concerto CRT-D VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Concerto II CRT-D VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Consulta CRT-D VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Evera ICD VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Maximo II CRT-D VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Maximo II ICD VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Mirro ICD VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Nayamed ND ICD VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Primo ICD VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Protecta ICD, Protecta CRT-D VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Secura ICD VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Virtuoso ICD VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Virtuoso II ICD VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Visia AF ICD VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Viva CRT-D VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Brava CRT-D VendorMedtronic Affected All versions Fixed in — No fix listed CNA
- Mirro MRI ICD VendorMedtronic Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 46
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:medtronic:mycarelink_monitor_24950_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:mycarelink_monitor_24950:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:mycarelink_monitor_24952_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:mycarelink_monitor_24952:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:carelink_monitor_2490c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:carelink_monitor_2490c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:carelink_2090_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:carelink_2090:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:amplia_crt-d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:amplia_crt-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
- cpe:2.3:o:medtronic:mycarelink_monitor_24950_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:mycarelink_monitor_24950:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:mycarelink_monitor_24952_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:mycarelink_monitor_24952:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:carelink_monitor_2490c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:carelink_monitor_2490c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:carelink_2090_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:carelink_2090:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:amplia_crt-d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:amplia_crt-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
Show 36 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:medtronic:claria_crt-d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:claria_crt-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:compia_crt-d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:compia_crt-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:concerto_crt-d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:concerto_crt-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:concerto_ii_crt-d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:concerto_ii_crt-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:consulta_crt-d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:consulta_crt-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:evera_icd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:evera_icd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:maximo_ii_crt-d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:maximo_ii_crt-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:maximo_ii_icd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:maximo_ii_icd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:mirro_icd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:mirro_icd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:nayamed_nd_icd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:nayamed_nd_icd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:primo_icd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:primo_icd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:protecta_icd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:protecta_icd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:protecta_crt-d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:protecta_crt-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:secura_icd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:secura_icd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:virtuoso_icd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:virtuoso_icd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:virtuoso_ii_icd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:virtuoso_ii_icd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:visia_af_icd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:visia_af_icd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
| cpe:2.3:o:medtronic:viva_crt-d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Medtronic |
| cpe:2.3:h:medtronic:viva_crt-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Medtronic |
- cpe:2.3:o:medtronic:claria_crt-d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:claria_crt-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:compia_crt-d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:compia_crt-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:concerto_crt-d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:concerto_crt-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:concerto_ii_crt-d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:concerto_ii_crt-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:consulta_crt-d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:consulta_crt-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:evera_icd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:evera_icd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:maximo_ii_crt-d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:maximo_ii_crt-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:maximo_ii_icd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:maximo_ii_icd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:mirro_icd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:mirro_icd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:nayamed_nd_icd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:nayamed_nd_icd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:primo_icd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:primo_icd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:protecta_icd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:protecta_icd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:protecta_crt-d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:protecta_crt-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:secura_icd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:secura_icd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:virtuoso_icd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:virtuoso_icd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:virtuoso_ii_icd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:virtuoso_ii_icd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:visia_af_icd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:visia_af_icd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
- cpe:2.3:o:medtronic:viva_crt-d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Medtronic
- cpe:2.3:h:medtronic:viva_crt-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Medtronic
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-6540
- 2026-10-03 Alias added: GHSA-r6ff-m2x2-m36p
References
More Medtronic Amplia Crt-d Firmware vulnerabilities
- TI-2019-04592 Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control CVSS 3.1CRITICAL 9.3
Sources
- CVE-2019-6540 · CVE Program
- CVE-2019-6540 · NVD
- FIRST EPSS
- GHSA-r6ff-m2x2-m36p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences