Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.6

Medtronic Energy Platforms Allow Unauthorized Instrument Connection

CVE-2019-13531 · published 6 years ago
Summary

Medtronic's Valleylab FT10 and LS10 Energy Platforms have a security flaw that allows counterfeit medical devices to connect to the platform, which could lead to incorrect or even life-threatening treatment. This affects certain versions of the software, and users should update to the latest version to prevent unauthorized connections.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
medtronic valleylab_ft10_energy_platform_firmware 2.0.3
2.1.0
cpe:2.3:o:medtronic:valleylab_ft10_energy_platform_firmware:2.0.3:*:*:*:*:*:*:*
medtronic valleylab_ls10_energy_platform_firmware <= 1.20.2
cpe:2.3:o:medtronic:valleylab_ls10_energy_platform_firmware:*:*:*:*:*:*:*:*
Original advisory text
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) versio...
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments can be bypassed, allowing for inauthentic instruments to connect to the generator.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published8 Nov 2019
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2019-13531 · NVD
Track software like this
Free during beta