CVE-2019-6538 — The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor vers

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D

01What is this vulnerability?

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia…

02Affected products

Vendor	Product	Versions
Medtronic	Conexus Radio Frequency Telemetry Protocol	All versions
Medtronic	MyCareLink Monitor	24950, 24952
Medtronic	CareLink Monitor	2490C
Medtronic	CareLink 2090 Programmer	All versions
Medtronic	Amplia CRT	D — All versions
Medtronic	Claria CRT	D — All versions
Medtronic	Compia CRT	D — All versions
Medtronic	Concerto CRT	D — All versions
Medtronic	Concerto II CRT	D — All versions
Medtronic	Consulta CRT	D — All versions
Medtronic	Evera ICD	All versions
Medtronic	Maximo II CRT	D — All versions
Medtronic	Maximo II ICD	All versions
Medtronic	Mirro ICD	All versions
Medtronic	Nayamed ND ICD	All versions
Medtronic	Primo ICD	All versions
Medtronic	Protecta ICD, Protecta CRT	D — All versions
Medtronic	Secura ICD	All versions
Medtronic	Virtuoso ICD	All versions
Medtronic	Virtuoso II ICD	All versions
Medtronic	Visia AF ICD	All versions
Medtronic	Viva CRT	D — All versions
Medtronic	Brava CRT	D — All versions
Medtronic	Mirro MRI ICD	All versions

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2019-03-25T21:26:03.000Z
• Last modified: 2025-05-22T19:26:15.126Z

09References

• ics-cert.us-cert.gov — https://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01
• www.securityfocus.com — http://www.securityfocus.com/bid/107544