Medtronic has applied additional controls for monitoring and responding to improper use of the Conexus telemetry protocol in the MyCareLink Monitor, CareLink Monitor, CareLink 2090 Programmer, and various Medtronic implanted cardiac devices, according to a report with NCCIC.
In addition, other mitigations are being developed and will end up deployed through future updates, after regulatory approval.
The vulnerabilities are improper access control, and cleartext transmission of sensitive information.
Successful exploitation of these vulnerabilities may allow an attacker with adjacent short-range access to one of the affected products to interfere with, generate, modify, or intercept the radio frequency (RF) communication of the Medtronic proprietary Conexus telemetry system, potentially impacting product functionality and/or allowing access to transmitted sensitive data.
Peter Morgan of Clever Security; Dave Singelée and Bart Preneel of KU Leuven; Eduard Marin formerly of KU Leuven, currently with University of Birmingham; Flavio D. Garcia; Tom Chothia of the University of Birmingham, and Rik Willems of University Hospital Gasthuisberg Leuven reported these vulnerabilities.
Successful exploitation requires: An RF device capable of transmitting or receiving Conexus telemetry communication, such as a monitor, programmer, or software-defined radio (SDR); an adjacent short-range access to the affected products, and the products to be in states where the RF functionality is active.
Before the device implant procedure and during follow-up clinic visits, the Conexus telemetry sessions require initiation by an inductive protocol. Outside of these use environments, the RF radio in the affected implanted device is enabled for brief periods of time to support scheduled follow-up transmissions and other operational and safety notifications.
The result of successful exploitation of these vulnerabilities may include the ability to read and write any valid memory location on the affected implanted device and therefore impact the intended function of the device.
The following products and versions of Medtronic devices utilizing the Conexus telemetry protocol suffer from the issues:
• MyCareLink Monitor, Versions 24950 and 24952
• CareLink Monitor, Version 2490C
• CareLink 2090 Programmer
• Amplia CRT-D (all models)
• Claria CRT-D (all models)
• Compia CRT-D (all models)
• Concerto CRT-D (all models)
• Concerto II CRT-D (all models)
• Consulta CRT-D (all models)
• Evera ICD (all models)
• Maximo II CRT-D and ICD (all models)
• Mirro ICD (all models)
• Nayamed ND ICD (all models)
• Primo ICD (all models)
• Protecta ICD and CRT-D (all models)
• Secura ICD (all models)
• Virtuoso ICD (all models)
• Virtuoso II ICD (all models)
• Visia AF ICD (all models)
• Viva CRT-D (all models)
The Conexus telemetry protocol utilized within this ecosystem does not implement authentication or authorization. An attacker with adjacent short-range access to an affected product, in situations where the product’s radio is turned on, can inject, replay, modify, and/or intercept data within the telemetry communication. This communication protocol provides the ability to read and write memory values to affected implanted cardiac devices; therefore, an attacker could exploit this communication protocol to change memory in the implanted cardiac device.
CVE-2019-6538 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.3.
In addition, the Conexus telemetry protocol utilized within this ecosystem does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
CVE-2019-6540 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 6.5.
The products see use mainly in the healthcare and public health sectors. It also sees action on a global basis.
No known public exploits specifically target these vulnerabilities. These vulnerabilities require adjacent short-range access to the affected devices to be exploited. However, an attacker with low skill level could leverage the vulnerabilities.
Ireland-based Medtronic applied additional controls for monitoring and responding to improper use of the Conexus telemetry protocol by the affected implanted cardiac devices. Additional mitigations are being developed and will be deployed through future updates, after regulatory approval.
Medtronic recommends users take additional defensive measures to minimize the risk of exploitation of these vulnerabilities. Users should:
• Maintain good physical control over home monitors and programmers
• Use only home monitors, programmers, and implantable devices obtained directly from your healthcare provider or a Medtronic representative to ensure integrity of the system
• Do not connect unapproved devices to home monitors and programmers through USB ports or other physical connections
• Only use programmers to connect and interact with implanted devices in physically controlled hospital and clinical environments
• Only use home monitors in private environments such as a home, apartment, or otherwise physically controlled environment
• Report any concerning behavior regarding these products to your healthcare provider or a Medtronic representative
Medtronic released additional patient-focused information at the following location: