CVE-2019-13539

—

CVSS 3.1

7.8 high

EPSS

<1%p19

Published

Nov 8, 2019 (Nov 8, 2019)

Modified

Jun 17, 2026

Description

Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password hashing. While interactive, network-based logons are disabled, and attackers can use the other vulnerabilities within this report to obtain local shell access and access these hashes.

Vendors: medtronic
Products: valleylab exchange client, valleylab ft10 energy platform firmware, valleylab fx8 energy platform firmware
Weakness: CWE-328, CWE-326
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news1 stories

DHS CISA warns of Critical issues in Medtronic Medical equipment

Security AffairsNov 9, 08:35 UTC · Nov 9, 2019Advisory CVE-2019-13543 CVE-2019-13539 CVE-2019-3464+1 CVEs