#VU22637 Improper Authentication in Valleylab LS10 Energy Platform and Valleylab FT10 Energy Platform - CVE-2019-13531
Published: November 11, 2019
Vulnerability identifier: #VU22637
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-13531
CWE-ID: CWE-287
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Valleylab LS10 Energy Platform
Valleylab FT10 Energy Platform
Valleylab LS10 Energy Platform
Valleylab FT10 Energy Platform
Software vendor:
Medtronic
Medtronic
Description
The vulnerability allows a local attacker to bypass authentication process.
The vulnerability exists due to an error in the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments. An attacker with physical access to the device can connect inauthentic instruments to the generator, bypass authentication process and gain unauthorized access to the application.
Remediation
Install updates from vendor's website.