Vulnerability

Medtronic Conexus telemetry protocol lacks authentication and encryption across implanted defibrillators

MedDevice Cyber Staff · Mar 21 · 4 min read · Via CISA ICSMA-19-080-01

CISA published advisory ICSMA-19-080-01 on March 21, 2019, later revised through Update C, covering two vulnerabilities in the Medtronic Conexus radio frequency telemetry protocol. Conexus carries data between Medtronic implanted cardiac devices and the CareLink 2090 Programmer, the CareLink Monitor 2490C and the MyCareLink Monitor 24950 and 24952.

All versions of the affected implants are listed. On the CRT-D side: Amplia, Brava, Claria, Compia, Concerto, Concerto II, Consulta and Viva. On the ICD side: Evera, Mirro, Mirro MRI, Nayamed ND, Primo, Secura, Virtuoso, Virtuoso II and Visia AF. Maximo II and Protecta appear in both ICD and CRT-D form. Credited researchers include Peter Morgan of Clever Security, Dave Singelée and Bart Preneel of KU Leuven, Eduard Marin and Tom Chothia of the University of Birmingham, Flavio D. Garcia, and Rik Willems of University Hospital Gasthuisberg Leuven.

CVE-2019-6538 (CWE-284, CVSS v3 9.3) is the core finding: Conexus implements neither authentication nor authorization. An attacker with adjacent short-range access, while the product's radio is on, can inject, replay, modify or intercept telemetry data. The protocol can read and write memory values on the implant, so that access reaches the implanted device's memory directly.

CVE-2019-6540 (CWE-319, CVSS v3 6.5) is the companion flaw. Conexus does not implement encryption, so an attacker in range can listen to communications, including sensitive data.

Exploitation has real preconditions. The attacker needs an RF device able to speak Conexus, such as a monitor, programmer or software-defined radio, plus short-range proximity and a product whose radio is active. Before implant and during clinic follow-ups, a session must first be started by an inductive protocol; outside those settings the implant turns its radio on only briefly for scheduled transmissions and notifications. CISA states the flaws are not exploitable remotely.

Medtronic added controls for monitoring and responding to improper use of Conexus by the implants. It developed patches for a subset of models, installed during regular office visits, and said patches for more models would follow through future updates, assuming regulatory approval.

An unauthenticated protocol with memory write access to a defibrillator is a design decision that later patches only partly unwind. Authentication on the telemetry link has to ship in the first release.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Medtronic has patches for a subset of affected implant models, installed during regular office visits, with more to follow assuming regulatory approval; check Medtronic's security information for the current model list. Medtronic also added monitoring for improper Conexus use. For unpatched implants nothing fixes the missing authentication and encryption in CVE-2019-6538 and CVE-2019-6540, so control who holds Conexus-capable programmers and monitors.

Check each implant against the patch list. Medtronic patches a subset of models at office visits; match patients' devices to the current list Medtronic publishes.
Apply patches at the next visit. Install available patches during regular follow-up appointments.
Control programmer and monitor custody. Keep CareLink 2090 Programmers and home monitors accounted for, since any Conexus-capable radio can reach an implant in range.
Authenticate telemetry in new designs. Implant telemetry that can write device memory needs authentication and encryption from the first release.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Therapy delivery Home use

Conexus implantable cardiac devices (ICD and CRT-D)

PID-4111 PID-4112 Wireless connectivity

CareLink 2090 Programmer

PID-4111 PID-4112 Wireless connectivity

CareLink Monitor

PID-4111 PID-4112 Wireless connectivity

MyCareLink Monitor

PID-4111 PID-4112 Wireless connectivity

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Questions & Answers

Which Medtronic devices use the vulnerable Conexus telemetry protocol?

CISA advisory ICSMA-19-080-01, first published March 21, 2019, lists Medtronic Amplia, Brava, Claria, Compia, Concerto, Concerto II, Consulta and Viva CRT-Ds; Evera, Mirro, Mirro MRI, Nayamed ND, Primo, Secura, Virtuoso, Virtuoso II and Visia AF ICDs; Maximo II and Protecta ICDs and CRT-Ds; the CareLink 2090 Programmer; the CareLink Monitor 2490C; and the MyCareLink Monitor 24950 and 24952.

Can CVE-2019-6538 in Medtronic Conexus be exploited remotely?

No. CISA advisory ICSMA-19-080-01 states the Medtronic Conexus flaws are not exploitable remotely. CVE-2019-6538 (CVSS v3 9.3) requires an RF device capable of Conexus telemetry, adjacent short-range access to the implant or monitor, and a product whose radio is active.

Is there a patch for the Medtronic Conexus telemetry vulnerabilities?

Partly. Medtronic developed patches for a subset of affected implanted cardiac device models, installed during regular office visits, and said patches for more models would follow assuming regulatory approval, per CISA advisory ICSMA-19-080-01 (March 21, 2019). It also added monitoring for improper use of the Conexus protocol.

← Back to Vulnerabilities