CVE:CVE-2019-6538
CNNVD:CNNVD-201903-836
多款Medtronic产品中存在访问控制错误漏洞，该漏洞源于Conexus遥测协议没有执行授权或身份验证。攻击者可利用该漏洞注入，修改或拦截遥测通信中的输入。以下产品和版本受到影响：MyCareLink Monitor 24950版本，24952版本；CareLink Monitor 2490C版本；CareLink 2090 Programmer；Amplia CRT-D；Claria CRT-D；Compia CRT-D；Concerto CRT-D；Concerto II CRT-D；Consulta CRT-D；Evera ICD；Maximo II CRT-D；Maximo II ICD；Mirro ICD；Nayamed ND ICD；Primo ICD；Protecta ICD；Protecta CRT-D；Secura ICD；Virtuoso ICD；Virtuoso II ICD；Visia AF ICD；Viva CRT-D。
solution:Upgrade medtronic mycarelink_monitor_firmware to a higher version than 24950,24952,and avoid the version 24950,24952; Upgrade medtronic carelink_monitor_firmware to a higher version than 2490c,and avoid the version 2490c; Upgrade medtronic carelink_2090_firmware to a higher version than -; Upgrade medtronic amplia_crt-d_firmware to a higher version than -; Upgrade medtronic claria_crt-d_firmware to a higher version than -; Upgrade medtronic compia_crt-d_firmware to a higher version than -; Upgrade medtronic concerto_crt-d_firmware to a higher version than -; Upgrade medtronic concerto_ii_crt-d_firmware to a higher version than -; Upgrade medtronic consulta_crt-d_firmware to a higher version than -; Upgrade medtronic evera_icd_firmware to a higher version than -; Upgrade medtronic maximo_ii_crt-d_and_lcd_firmware to a higher version than -; Upgrade medtronic mirro_icd_firmware to a higher version than -; Upgrade medtronic nayamed_nd_icd_firmware to a higher version than -; Upgrade medtronic primo_icd_firmware to a higher version than -; Upgrade medtronic protecta_icd_and_crt-d_firmware to a higher version than -; Upgrade medtronic secura_icd_firmware to a higher version than -; Upgrade medtronic virtuoso_icd_firmware to a higher version than -; Upgrade medtronic virtuoso_ii_icd_firmware to a higher version than -; Upgrade medtronic visia_af_icd_firmware to a higher version than -; Upgrade medtronic viva_crt-d_firmware to a higher version than -