Unauthenticated, unencrypted RF telemetry

1. Summary

The Conexus proprietary radio-frequency (RF) telemetry protocol, used by Medtronic implantable cardiac defibrillators (ICDs) and CRT-D devices to communicate with home monitors and the CareLink 2090 Programmer, was designed with no authentication, no authorization, and no encryption [1][2]. Because the protocol never verifies who it is talking to, an attacker with a Conexus-capable radio in adjacent short-range wireless distance of an active device can intercept, inject, replay, and modify telemetry, and can read from and write to any valid memory location on the implant — potentially altering device behavior and therapy [1][8]. Because the same protocol transmits in cleartext, that attacker can also passively eavesdrop on sensitive patient and device telemetry [2]. Two CVEs split the issue into an integrity/access-control flaw (CVE-2019-6538) and a confidentiality flaw (CVE-2019-6540) [1][2][9].

2. Affected products & versions

Approximately 750,000 implanted devices are affected, spanning roughly 20 product models [8]. The enumerated implant families above number ~17, plus 4 monitor/programmer SKUs; the “~20 product models” figure is a source-reported aggregate from [8] and is not a contradiction with the enumerated list. The implant-family spellings above (including “Mirro ICD”) are consistent with the affected-device inventory in the primary NVD record [1]. Pacemakers and insertable cardiac monitors are not impacted [8].

3. The vulnerability in detail

The defect lives in the Conexus RF telemetry protocol layer — the proprietary wireless link that Medtronic implantable ICD and CRT-D devices use to talk to their peripheral accessories: the MyCareLink and CareLink home monitors and the CareLink 2090 Programmer used in clinical settings [1][8]. This is a protocol-design flaw, not an implementation bug tied to a particular file or function; the sources identify no specific source file or software routine [1]. There is no buffer overflow, no off-by-one, no parsing mistake to point at. Instead, the protocol was specified from the outset without two security properties that any link controlling a life-sustaining actuator must have: it authenticates and authorizes nobody, and it encrypts nothing [1][2][8].

The root cause of CVE-2019-6538 is the absence of authentication and authorization. When a Conexus frame arrives at an implant with its radio active, the device does not challenge the sender, does not verify a shared secret or certificate, and does not check whether the peer is permitted to perform the requested operation. Any radio in range that can speak the Conexus wire format is implicitly trusted as a legitimate monitor or programmer [1]. NVD classifies this under CWE-306 (Missing Authentication for Critical Function), CWE-862 (Missing Authorization), and CWE-284 (Improper Access Control) [1]. CWE-306 means a security-critical operation — here, reading and writing device memory that governs cardiac therapy — is exposed with no identity check at all; CWE-862 means that even where an operation might implicitly assume a caller “should” be a clinician’s programmer, no authorization decision is ever made; and CWE-284 is the umbrella access-control failure that results. The consequence of the missing check is severe precisely because of what the unauthenticated interface exposes: the ability to read and write any valid memory location on the implanted device, which can change device memory and thereby alter functionality and therapy [8].

The root cause of CVE-2019-6540 is the absence of encryption. Conexus transmits telemetry in cleartext, so any radio in range can passively recover patient and device data off the air [2]. This maps to CWE-319 (Cleartext Transmission of Sensitive Information): sensitive information crosses an untrusted medium — open RF — with no confidentiality protection, so eavesdropping requires only reception, not any active compromise [2]. The two flaws are independent but compounding: the missing encryption (CVE-2019-6540) means an attacker can first observe legitimate Conexus exchanges in the clear to learn the wire format and message structure, and the missing authentication (CVE-2019-6538) then means anything the attacker replays or synthesizes from that observation is accepted as legitimate. Neither flaw needs the other to be exploited, but together they lower the bar from “attack a proprietary link” to “record, understand, and replay/modify an open one.”

The mechanism that turns these design omissions into an attack is straightforward. Conexus accepts and processes frames from any in-range radio, without authenticating the peer and without encrypting the payload [1][2]. With the implant’s radio in an active/listening state, an adjacent attacker using a Conexus-capable radio — a Medtronic monitor, a CareLink 2090 Programmer, or a software-defined radio (SDR) — can inject, replay, modify, and intercept telemetry frames [1][8]. Two preconditions gate the attack: RF/physical adjacency (the attacker must be within adjacent short-range wireless distance, corresponding to CVSS attack vector Adjacent), and the device radio being active/listening [1][8]. No authentication, no user interaction, and no elevated privileges are required (PR:N/UI:N), and the exploit complexity and skill required are low [1][9]. It is worth being precise about what “low complexity” means here: the CVSS AC:L rating reflects that no adaptive conditions must be met once the attacker is in range and the radio is listening, but the practical bar of building a Conexus-speaking SDR stack was cleared by specialist academic reverse-engineering rather than by commodity tooling [6][9].

The exploitation chain is: (1) the attacker obtains RF equipment capable of transmitting and receiving Conexus telemetry — a Medtronic monitor, a CareLink 2090 Programmer, or an SDR [8]; (2) positions within adjacent short-range distance of a target implant while its radio is active/listening [1][8]; (3) because Conexus performs no authentication or authorization, the attacker’s radio is accepted as a legitimate peer [1]; (4) the attacker intercepts, injects, replays, or modifies telemetry on the unencrypted channel [1][2]; (5) via CVE-2019-6538 the attacker reads and writes valid memory locations on the implant, changing device memory and potentially altering functionality/therapy [8]; and (6) via CVE-2019-6540 the attacker passively captures cleartext patient/device telemetry, breaching confidentiality [2]. Steps (5) and (6) are separable outcomes of the same access: an attacker interested only in surveillance can stop at (6) with a purely passive receiver, while an attacker seeking to alter therapy needs the active read/write primitive of (5).

Proof-of-concept status: the technical feasibility of attacking this class of implant was established by peer-reviewed academic reverse-engineering of the proprietary long-range RF protocol — the ACSAC 2016 paper by Marin, Singelee, Garcia, Chothia, Willems, and Preneel [6][7]. Full technical detail — PoC specifics, demonstrated range, and defenses — is documented in that ACSAC 2016 paper [6][7].

4. Discovery & timeline

The vulnerabilities were reported to NCCIC/ICS-CERT (DHS/CISA) by a research team credited as Peter Morgan (Clever Security); Dave Singelee and Bart Preneel (KU Leuven); Eduard Marin, Flavio D. Garcia, and Tom Chothia (University of Birmingham); and Rik Willems [4][9]. The technical foundation is the ACSAC 2016 paper “On the (in)security of the Latest Generation Implantable Cardiac Defibrillators and How to Secure Them,” first-authored by Eduard Marin with the same co-author group [6][7]. DHS/CISA published the coordinated ICS-Medical advisory ICSMA-19-080-01 in March 2019 (the referenced revision is Update C) [4]. Medtronic responded with monitoring controls and indicated that a first software update was scheduled for later in 2019, pending regulatory approval, with additional protections in future updates [5][8]. Precise coordinated-disclosure dates beyond the 2016 paper and the 2019 advisory are not documented in public advisories.

5. Technical reference

• CVEs: CVE-2019-6538 (missing authentication/authorization; memory read/write) [1]; CVE-2019-6540 (cleartext transmission) [2].
• CWEs: CVE-2019-6538 — CWE-306, CWE-862, CWE-284 [1]. CVE-2019-6540 — CWE-319 [2].
• CVSS 3.1 vectors:
• CVE-2019-6538, ICS-CERT/CNA: 9.3 CRITICAL — AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H [1][4]. The scored drivers are scope-changed (S:C) with High integrity and High availability impact.
• CVE-2019-6538, NIST/NVD: 6.5 MEDIUM — AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N [1]. NIST scored scope Unchanged and availability None, retaining only the High integrity impact — hence the large divergence from the ICS-CERT score.
• CVE-2019-6540, CNA/ICS-CERT: 6.5 MEDIUM — AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N [2]. Confidentiality-only (C:H) with no integrity or availability impact, consistent with a passive eavesdropping flaw. NIST had not provided its own assessment for CVE-2019-6540 at time of record [2].
• On the S:C-vs-S:U divergence (inference — not in public advisories): The ICS-CERT/CNA score marks scope Changed and availability High while NIST marks both scope Unchanged and availability None, which alone accounts for 9.3 CRITICAL vs 6.5 MEDIUM on the same integrity flaw. The published records confirm the fact of this divergence [1], but public advisories do not document the scorers’ rationale for the scope or availability disagreement. A plausible reading is that a Changed scope reflects the compromised radio-protocol layer being a different security authority than the therapy-delivering implant it can then reach, but this is the author’s inference and is explicitly not sourced gaps.
• Common metrics across both: Adjacent attack vector (AV:A), Low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N) — the interface is reachable by any in-range radio with no credentials [1][2].
• Code/commit refs: none — protocol-design flaw, not a code-level fix identified in sources. Underlying research: ACSAC 2016, DOI 10.1145/2991079.2991094 [6].

6. Consequence & CFSE path analysis

Real-world consequence. An attacker with specialist radio gear, physically close to a patient whose implant radio is active, can alter the memory and settings that govern how a pacemaker/ICD delivers therapy — potentially causing wrong therapy — and can separately eavesdrop on that patient’s device and health data. The consequence is demonstrated feasible.

Why the CFSE Path Score differs from CVSS. CVSS produced two divergent numbers for the same integrity flaw — ICS-CERT’s 9.3 CRITICAL versus NIST’s 6.5 MEDIUM — because the two scorers disagreed on scope and availability, and CVSS has no native way to weigh that this is a safety-relevant actuator rather than an IT asset. The CFSE path model sidesteps that ambiguity by scoring consequence directly against what the vulnerability lets an attacker actuate, then carrying exposure and evidence as separate axes. It decomposes CPATH-2026-0035 into two co-dominant CRITICAL paths rather than collapsing to a single base metric.

CFSE consequence bands and verdict:

• DEVICE_CONTROL_SAFETY (safety) path — CRITICAL. The Conexus protocol allows unauthenticated read/write to implanted-device memory and settings, so an adjacent attacker (device must be listening) with specialist radio gear can alter pacemaker/ICD therapy, a severe wrong-therapy consequence (PH:4). Recovery is fleet-action/replacement because many legacy implants cannot be field-patched (OR:4).
• DATA_PRIVACY (privacy) path — CRITICAL. The lack of encryption lets an attacker intercept, replay, or modify sensitive patient/device telemetry (DP:3), but its physical impact is bounded to data falsification (PH:2) with session-bounded authority (AT:2).
• Shared axes. Both paths share exposure EX:2 (adjacent RF reachability, advanced-but-reproducible complexity), portable product-class technique (SR:3), per-device proximity execution with no remote fleet channel (SX:2), and report-backed evidence with no observed in-the-wild exploitation (EV:2, LS partially mitigated).
• Caps/uplift. No cap or systemic uplift changes either base band.

Overall path verdict: CRITICAL, direction SIDEWAYS, driven by influence over a safety-relevant actuation. The SIDEWAYS direction reflects that the dominant risk is per-device proximity actuation rather than a remote, fleet-wide channel — the technique is portable and reproducible but must be executed device-by-device within RF range.

7. Remediation & mitigations

At advisory time no patch existed [8]. The specific, grounded measures are:

• Use only authorized hardware. Use only Medtronic- or provider-supplied monitors and programmers, obtained directly from a healthcare provider or Medtronic [9]. This does not close the protocol flaw but limits the supply of rogue Conexus-capable Medtronic equipment in circulation.
• Maintain physical control of home monitors, and use them in private environments — this shrinks the adjacent-RF attack surface (AV:A) that the flaw depends on, since exploitation requires an attacker radio within short range of the patient [9].
• Report suspicious behavior of monitors or the implant to the provider — the only patient-side detection channel, given the link itself cannot flag rogue peers [9].
• Vendor-side telemetry monitoring. Medtronic implemented additional network/back-end controls to monitor for and respond to unauthorized or anomalous use of Conexus telemetry — a compensating control specific to this protocol, given the link itself cannot verify peers [5][9].
• Phased, regulator-approved firmware updates. Medtronic committed to phased security updates delivering further protections; the first was scheduled for later in 2019 pending regulatory approval [5][8]. The durable fix requires adding authentication/authorization (closing CVE-2019-6538) and encryption (closing CVE-2019-6540) to the telemetry link itself.
• Replacement for non-updatable devices. Many legacy implants cannot be field-patched, so remediation for some devices relies on the compensating controls above rather than a firmware fix, and in the limit on device replacement.

No generic SOC/network controls are applicable here — the vulnerable channel is RF, not IP. Detection is bounded to the physical/RF proximity of the patient and to Medtronic’s own back-end telemetry monitoring, not to conventional network defenses.

8. Sources

[1] NVD - CVE-2019-6538 — NVD (NIST) — https://nvd.nist.gov/vuln/detail/CVE-2019-6538 — Primary record for the missing-auth/access-control flaw; confirmed the dual CVSS scoring discrepancy (ICS-CERT 9.3 CRITICAL S:C/I:H/A:H vs NIST 6.5 MEDIUM S:U), CWE set, affected device list, and memory-write impact — primary-advisory. [2] NVD - CVE-2019-6540 — NVD (NIST) — https://nvd.nist.gov/vuln/detail/CVE-2019-6540 — Primary record for the cleartext/encryption flaw; confirmed 6.5 MEDIUM (C:H/I:N/A:N) vector, CWE-319, and that NIST had not yet scored it — primary-advisory. [3] CVE.org - CVE-2019-6538 authoritative CVE record — CVE.org (MITRE / ICS-CERT CNA) — https://www.cve.org/CVERecord?id=CVE-2019-6538 — Canonical CVE record and discoverer reference; establishes CNA assignment and researcher credit — primary-advisory. [4] Medtronic Conexus RF Telemetry Protocol (Update C) - ICSMA-19-080-01 — CISA / ICS-CERT — https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-080-01 — Government advisory; source of the 9.3 CRITICAL headline, authoritative affected-product inventory, mitigations, and researcher credits — primary-advisory. [5] Medtronic Security Bulletin - Conexus Telemetry & Monitoring Accessories — Medtronic (vendor) — https://global.medtronic.com/xg-en/product-security/security-bulletins/conexus.html — Vendor bulletin describing affected devices and the phased, regulator-approved mitigation updates — primary-advisory. [6] On the (in)security of the Latest Generation Implantable Cardiac Defibrillators and How to Secure Them (ACSAC 2016) — ACM (ACSAC ’16), Marin/Singelee/Garcia/Chothia/Willems/Preneel — https://dl.acm.org/doi/10.1145/2991079.2991094 — Underlying peer-reviewed research reverse-engineering the proprietary RF protocol and demonstrating the missing auth/encryption — researcher-primary. [7] Eduard Marin - academic homepage — Eduard Marin (University of Birmingham / Telefonica) — https://edumarin.github.io/ — First-author page confirming the ACSAC 2016 publication and authorship, corroborating discoverer attribution — researcher-primary. [8] Medtronic Defibrillators Have Critical Flaws, Warns DHS — Threatpost — https://threatpost.com/medtronic-defibrillators-have-critical-flaws-warns-dhs/143068/ — Reputable press; contributed the ~750,000 affected-device figure, the read/write-any-memory impact, the attacker-equipment scenario (monitor/programmer/SDR), and the “no patch / no harm observed” status — reputable-press. [9] Critical Vulnerability Affects Medtronic CareLink Monitors, Programmers, and ICDs — HIPAA Journal — https://www.hipaajournal.com/critical-vulnerability-medtronic-carelink-monitors-programmers-icds/ — Healthcare-sector press summarizing both CVEs, the confidentiality-vs-integrity split mapping to the two consequence paths, low-skill/adjacent preconditions, and interim mitigation guidance — reputable-press.