1. Home
  2. CVE Database
  3. CVE-2019-18254
MEDIUM · 4.6

CVE-2019-18254

BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data an...

Vulnerability Description

BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data and the serial number from the implanted cardiac device the CardioMessenger is paired with.

CVSS Score

4.6

MEDIUM

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
BiotronikCardiomessenger Ii-S Gsm Firmware2.20
BiotronikCardiomessenger Ii-S Gsm-
BiotronikCardiomessenger Ii-S T-Line Firmware2.20
BiotronikCardiomessenger Ii-S T-Line-

Related Weaknesses (CWE)

CWE-312CWE-311

References

FAQ

What is CVE-2019-18254?

CVE-2019-18254 is a vulnerability with a CVSS score of 4.6 (MEDIUM). BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data an...

How severe is CVE-2019-18254?

CVE-2019-18254 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-18254?

Check the references section above for vendor advisories and patch information. Affected products include: Biotronik Cardiomessenger Ii-S Gsm Firmware, Biotronik Cardiomessenger Ii-S Gsm, Biotronik Cardiomessenger Ii-S T-Line Firmware, Biotronik Cardiomessenger Ii-S T-Line.