CVE-2019-13539 - CVE House
Back to Database
Status published High CVE-2019-13539

Medtronic Valleylab FT10 and FX8 Reversible One-way Hash

Vulnerability Description

Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password hashing. While interactive, network-based logons are disabled, and attackers can use the other vulnerabilities within this report to obtain local shell access and access these hashes.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-13539

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Medtronic reported these vulnerabilities to CISA.

References

More from Medtronic

View All →
CVE-2025-4397
Medtronic MyCareLink Patient Monitor Data Encryption Weakness
Medium 6.8
CVE-2025-4395
Medtronic MyCareLink Patient Monitor Empty Password Vulnerability
Medium 6.8
CVE-2025-4394
Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability
Medium 6.8
CVE-2025-4393
Medtronic MyCareLink Patient Monitor Deserialization Vulnerability
Medium 6.5
CVE-2025-4386
Medtronic MyCareLink Patient Monitor Hardware Debug Port
Medium 6.8

Affected Vendor

Affected Software

Valleylab Exchange Client, Valleylab FT10 Energy Platform (VLFT10GEN), Valleylab FX8 Energy Platform (VLFX8GEN)
Vulnerable Versions:
0

Timeline

Official Publish: November 8th, 2019
Last Modified: May 22nd, 2025
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-328

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.