CVE-2019-18256

BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. An attacker with physical access to the CardioMessenger can use these credentials for network authentication and decryption of local data in transit.

Score

CVSS 3.1 4.6 Medium

Status

Modified - ics-cert@hq.dhs.gov

Published

2020-06-29

Last modified

2024-08-05

Weaknesses

CWE-257, CWE-522

Affected products

• Cardiomessenger Ii-s Gsm Firmware (Biotronik)
• Cardiomessenger Ii-s T-line Firmware (Biotronik)

References

• https://www.us-cert.gov/ics/advisories/icsma-20-170-05