Improper Authentication in Valleylab LS10 Energy Platform and Valleylab FT10 Energy Platform - CVE-2019-13531
Published: November 11, 2019
Vulnerability identifier: #VU22637
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-13531
CWE-ID: CWE-287
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Medtronic
Affected software:
Valleylab LS10 Energy Platform
Valleylab FT10 Energy Platform
Valleylab LS10 Energy Platform
Valleylab FT10 Energy Platform
Detailed vulnerability description
The vulnerability allows a local attacker to bypass authentication process.
The vulnerability exists due to an error in the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments. An attacker with physical access to the device can connect inauthentic instruments to the generator, bypass authentication process and gain unauthorized access to the application.
How to mitigate CVE-2019-13531
Install updates from vendor's website.