PatchTheCVECVE-2019-18254: BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest
CVE-2019-18254 is a medium-severity flaw (CVSS 4.6) affecting cardiomessenger ii-s gsm firmware, cardiomessenger ii-s t-line firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data and the serial number from the implanted cardiac device the CardioMessenger is paired with.
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-18254?
cardiomessenger ii-s gsm firmware: mitigate or apply the listed mitigation; cardiomessenger ii-s t-line firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2019-18254 being exploited?
CVE-2019-18254 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-18254 affect?
CVE-2019-18254 affects cardiomessenger ii-s gsm firmware, cardiomessenger ii-s t-line firmware. Severity is medium (CVSS 4.6). BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data and the serial number from the implanted c
How urgent is CVE-2019-18254?
Priority 19/100. No elevated risk signals yet.
Related CVEs
- CVE-2019-18256 MEDIUM 4.6 MITIGATE MITIGATE BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a
- CVE-2019-18252 MEDIUM 4.3 MITIGATE MITIGATE BIOTRONIK CardioMessenger II, The affected products allow credential reuse for multiple authentication purpose
- CVE-2019-18248 MEDIUM 4.3 MITIGATE MITIGATE BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to a
- CVE-2019-18246 MEDIUM 4.3 MITIGATE MITIGATE BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIO