CVE-2019-6538: Medtronic Amplia Crt-D Firmware

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement authentication or authorization. An attacker with adjacent short-range access to an affected product, in situations where the product’s radio is turned on, can inject, replay, modify, and/or intercept data within the telemetry communication. This communication protocol provides the ability to read and write memory values to affected implanted cardiac devices; therefore, an attacker could exploit this communication protocol to change memory in the implanted cardiac device.

Affected products

  • Medtronic Amplia Crt-D Firmware: affected versions not specified
  • Medtronic Carelink 2090 Firmware: affected versions not specified
  • Medtronic Carelink Monitor Firmware: version 2490c only
  • Medtronic Claria Crt-D Firmware: affected versions not specified
  • Medtronic Compia Crt-D Firmware: affected versions not specified
  • Medtronic Concerto Crt-D Firmware: affected versions not specified
  • Medtronic Concerto Ii Crt-D Firmware: affected versions not specified
  • Medtronic Consulta Crt-D Firmware: affected versions not specified
  • Medtronic Evera Icd Firmware: affected versions not specified
  • Medtronic Maximo Ii Crt-D And Lcd Firmware: affected versions not specified
  • Medtronic Mirro Icd Firmware: affected versions not specified
  • Medtronic Mycarelink Monitor Firmware: version 24950 only; version 24952 only
  • Medtronic Nayamed Nd Icd Firmware: affected versions not specified
  • Medtronic Primo Icd Firmware: affected versions not specified
  • Medtronic Protecta Icd And Crt-D Firmware: affected versions not specified
  • Medtronic Secura Icd Firmware: affected versions not specified
  • Medtronic Virtuoso Icd Firmware: affected versions not specified
  • Medtronic Virtuoso Ii Icd Firmware: affected versions not specified
  • Medtronic Visia Af Icd Firmware: affected versions not specified
  • Medtronic Viva Crt-D Firmware: affected versions not specified

Published 2019-03-25. Last modified 2026-06-17.