Skip to content
Fencer Vulns
high 7.0

CVE-2019-13539 json

Medtronic Valleylab FT10 and FX8 Reversible One-way Hash

published 2019-11-08 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-4994

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password hashing. While interactive, network-based logons are disabled, and attackers can use the other vulnerabilities within this report to obtain local shell access and access these hashes.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-19-311-02 updated cvss 7.0

Medtronic Valleylab FT10 and FX8

  • Medtronic Valleylab Exchange Client <= 3.4 Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) software <= 4.0.0 Medtronic Valleylab FX8 Energy Platform (VLFX8GEN) software <= 1.0.0
    affected: vendor fix medtronic.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Medtronic Valleylab Exchange Client
  • Medtronic Valleylab FT10 Energy Platform (VLFT10GEN)
  • Medtronic Valleylab FX8 Energy Platform (VLFX8GEN)

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.