Vulnerability

Medtronic Valleylab FT10 and LS10 energy platforms accept inauthentic instruments through RFID bypass

MedDevice Cyber Staff · Nov 7 · 2 min read · Via CISA ICSMA-19-311-01

CISA published advisory ICSMA-19-311-01 on November 7, 2019, for two vulnerabilities in Medtronic Valleylab energy platforms: the FT10 Energy Platform (VLFT10GEN) at versions 2.0.3 and earlier and 2.1.0 and earlier, and the LS10 Energy Platform (VLLS10GEN) at 1.20.2 and earlier. Medtronic reported the issues itself. The platforms are generators that deliver energy through connected instruments, and each instrument identifies itself to the generator over RFID.

CVE-2019-13531 (CWE-287, CVSS v3 4.8) is a bypass of the RFID security mechanism used for authentication between the platform and its instruments, which lets inauthentic instruments connect to the generator. CVE-2019-13535 (CWE-693, CVSS 4.6) is the enabling flaw: the RFID mechanism applies no read protection, so its security data can be read in full.

Both require physical access, and CISA states they are not exploitable remotely. The consequence is incorrect identification of an instrument and its associated parameters, which CISA says may cost performance integrity and platform availability.

Medtronic released a software patch for the affected Valleylab platforms, obtained by contacting Medtronic. RFID data that can be read in full can be copied, so instrument authentication built on it holds only until someone tries.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Medtronic released a software patch for the Valleylab FT10 and LS10 Energy Platforms; contact Medtronic to obtain it. The flaws need physical access and are not exploitable remotely, so instrument sourcing is the main interim control. Report any instrument suspected of not being FDA cleared for use with these platforms to Medtronic or the supplier.

Apply the Medtronic patch. Request the Valleylab software patch from Medtronic for FT10 units at 2.1.0 and earlier and LS10 units at 1.20.2 and earlier.
Control instrument sourcing. Buy instruments only through channels that can confirm FDA clearance for use with the FT10 or LS10.
Report suspect instruments. Contact Medtronic or the supplier about any instrument whose origin cannot be confirmed.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Therapy delivery

Valleylab FT10 Energy Platform

Wireless connectivity Therapy delivery

Valleylab LS10 Energy Platform

Wireless connectivity Therapy delivery

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
WavelinQ Generator	BD	Same FDA device type	No feedback feed from manufacturer
da Vinci E-200 Electrosurgical Generator	Intuitive	Same FDA device type	No feedback feed from manufacturer
Megadyne Telescoping Smoke Evacuation Pencil - 10ft tubing	Johnson & Johnson MedTech	Same FDA device type	No feedback feed from manufacturer
Bipolar applicator CelonProBreath (WB990310)	Olympus	Same FDA device type	No feedback feed from manufacturer
POWERSEAL Curved Jaw Sealer and Divider, Double Action	Olympus	Same FDA device type	No feedback feed from manufacturer
Ultrasonic Bipolar Generator (USG-410)	Olympus	Same FDA device type	No feedback feed from manufacturer

Questions & Answers

What is CVE-2019-13531 in the Medtronic Valleylab FT10 Energy Platform?

CVE-2019-13531 (CVSS v3 4.8) lets the RFID security mechanism between the Medtronic Valleylab FT10 or LS10 Energy Platform and its instruments be bypassed, so inauthentic instruments can connect to the generator. CISA disclosed it in ICSMA-19-311-01 on November 7, 2019, alongside CVE-2019-13535.

Is there a patch for the Medtronic Valleylab FT10 and LS10 RFID vulnerabilities?

Yes. Medtronic released a software patch for the Valleylab FT10 (VLFT10GEN) and LS10 (VLLS10GEN) Energy Platforms that addresses CVE-2019-13531 and CVE-2019-13535; users obtain it by contacting Medtronic, per CISA advisory ICSMA-19-311-01.

← Back to Vulnerabilities