PatchTheCVECVE-2019-18252: BIOTRONIK CardioMessenger II, The affected products allow credential reuse for multiple authentication purpose
CVE-2019-18252 is a medium-severity flaw (CVSS 4.3) affecting cardiomessenger ii-s gsm firmware, cardiomessenger ii-s t-line firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
BIOTRONIK CardioMessenger II, The affected products allow credential reuse for multiple authentication purposes. An attacker with adjacent access to the CardioMessenger can disclose its credentials used for connecting to the BIOTRONIK Remote Communication infrastructure.
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 58%) |
| CISA exploited list | No |
| Weakness | CWE-287 |
| Published | 2020-06-29 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-18252?
cardiomessenger ii-s gsm firmware: mitigate or apply the listed mitigation; cardiomessenger ii-s t-line firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2019-18252 being exploited?
CVE-2019-18252 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-18252 affect?
CVE-2019-18252 affects cardiomessenger ii-s gsm firmware, cardiomessenger ii-s t-line firmware. Severity is medium (CVSS 4.3). BIOTRONIK CardioMessenger II, The affected products allow credential reuse for multiple authentication purposes. An attacker with adjacent access to the CardioMessenger can disclose its credentials used for connecting to the BIOTRONIK Remot
How urgent is CVE-2019-18252?
Priority 25/100. No elevated risk signals yet.
Related CVEs
- CVE-2019-18256 MEDIUM 4.6 MITIGATE MITIGATE BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a
- CVE-2019-18254 MEDIUM 4.6 MITIGATE MITIGATE BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest
- CVE-2019-18248 MEDIUM 4.3 MITIGATE MITIGATE BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to a
- CVE-2019-18246 MEDIUM 4.3 MITIGATE MITIGATE BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIO