You just clicked a link to go to another website. If you continue, you will leave this site and go to a site run by someone else.
It is possible that some of the products on the other site are not approved in your country.
The content on this site may not be allowed under the laws of your country of residence. Please review the applicable healthcare laws in your country. If not allowed, please exit this site. Medtronic declines any liability as to your access to such information.
Click “Continue” to close this window and view the site’s content.
Your browser is out of date
With an updated browser, you will have a better Medtronic website experience. Update my browser now.
Medtronic, Inc. (“Medtronic”) offers RemoteView, which permits a user (“Programmer User”) of the Medtronic CareLink® 2090 Programmer (“Programmer”) to allow the viewing of information presently displayed on the Programmer screen with one or more individuals in remote locations anywhere in the world (“Remote Viewer”), including remote health care professionals or Medtronic representatives.
Limited License Grant. You are hereby granted a nonexclusive, nontransferable, terminable, nonassignable, nonsublicensable, limited license to install and use a copy of the Licensed Software solely for authorized and legitimate purposes. You may not otherwise copy, use, modify, reverse engineer, decompile, disassemble, create derivative works based on, or integrate with other systems or programs the Licensed Software without the prior written consent of Medtronic. You shall have sole responsibility for any fees or charges, including service or data charges, incurred by you in connection with your use of the Licensed Software. You shall not remove any proprietary or other legend or restrictive notice contained or included in the Licensed Software or other documentation associated with such Licensed Software. You agree to maintain any and all copyright, trademark, and other notices on the Licensed Software and any associated documentation.
Licensed Software Functionality and Data Use, Collection, Viewing, and Transfer.
“Active Remote Viewer” as referred to herein shall mean a Remote Viewer that has installed the Licensed Software and has at the relevant point in time an active network connection to a Medtronic server via the Licensed Software.
By installing or using the Licensed Software or clicking any acceptance button in connection with this Agreement, you acknowledge, understand, agree to, and consent to all of the following, including when you are an Active Remoter User:
) Registration. To obtain access to the Licensed Software, you must register at the Medtronic RemoteView website and establish a user name and password. All information that you provide in connection with such registration must be complete, accurate, and truthful. The user name and password are personal to you and must not be shared with anyone else. You will also not attempt, directly or indirectly, to disable, bypass, or defeat any password protection associated with the Licensed Software. Medtronic reserves the right to deny or disable any user name or password or request for any user name or password.
) Your Personal Information. Medtronic will collect information in connection with your registration and installation and use of the Licensed Software, including your first and last name, your email address, a selected security question(s) and your corresponding answer(s), your address, and your telephone number. You agree that Medtronic may store this personal information about you on a Medtronic server, including a server located in the United States of America.
) Session Key. To view the information on the Programmer, the Remote Viewer must generate a Session Key that must be shared with and entered by the Programmer User. “Session Key” as used herein means a unique token active for a limited period of time generated by the Remote Viewer. You agree not to share this Session Key with anyone other than the Programmer User who has initiated the specific session.
) Logging of Session Activity. Each time you log in to the Licensed Software, Medtronic will collect information about your activity, including in an aggregated log or database, regarding you and your session, including your name, username, computer name, IP address, operating system details, and session details (including transferring and sharing activity, start and end times, view only or control activity, and any chat messages between or among any Active Remote Viewers. You agree that Medtronic may store any personal information about you on a Medtronic server, including a server located in the United States of America.
) Active Remote Users. When you are an Active Remote Viewer: (1) you will be able to view the name and/or user name of any other Active Remote Viewer who is logged into the same Medtronic server; and (2) any other Active Remote Viewer who is actively logged into the same Medtronic server will be able to view your name and/or user name. The Licensed Software also permits one Active Remote Viewer to share the information being viewed to any other Active Remote Viewer. You must not share any information from the Medtronic programmer, including with any other Active Remote Viewer, absent the express permission from the Programmer User that is allowing you to view the information.
) Availability. Medtronic has limitations on the number of users that can concurrently log in to the Licensed Software at any given time. Thus, installation of or accessing the Licensed Software does not guarantee that it will be available to you for use at any time.
Permissions. By installing and using the Licensed Software, you represent that you have permission to do so from any associated clinic, hospital, or medical practice and that your use of the Licensed Software complies with any policies or requirements of such associated clinic, hospital, or medical practice. You are also responsible for confirming that the Programmer User has obtained any necessary patient consent before allowing you to view any patient information via the Licensed Software.
Your Acknowledgements. You acknowledge that the Licensed Software is not the exclusive method of viewing information from the Programmer and that the Licensed Software is not the exclusive method by which to obtain a patient’s implanted cardiac device data, including any data on the Programmer. You also acknowledge that the Licensed Software is not intended to be used as a life-sustaining or interventional tool during medical emergencies. You further acknowledge that Medtronic is not, and shall not be deemed to be, a provider of patient health care services by virtue of its provision of access to the Programmer screen information via the Licensed Software. You also acknowledge that information from the Licensed Software is not an electronic medical record and use of the Licensed Software does not in any way relieve you from using your best medical judgment to determine a proper course of treatment for patients.
Security/Privacy of Patient Data. Your use of the Licensed Software and any Session Keys shall be solely for legitimate and lawful purposes and not for any malicious purpose. You are solely responsible for and will use your best efforts in maintaining the confidentiality and security of any copies of the Licensed Software as well as any user name, password credentials, and any Session Keys that can be used in accessing the Licensed Software, a Medtronic server, or any information from a Programmer. You are solely responsible for and will use your best efforts in keeping any patient information you may receive or view in connection with the Licensed Software confidential and secure, and you will not attempt to capture or copy any patient information you view in any electronic or hard copy format without the express permission of the Programmer User. You will be responsible for any obligations or liabilities associated with any lost, stolen, or otherwise compromised patient information.
Reporting Issues and Feedback. You agree that you will report any issues or questions, technical or otherwise, regarding the Licensed Software promptly and directly to Medtronic. If you submit any comments or ideas to Medtronic, in the absence of a separate agreement regarding such submissions, you grant to Medtronic an unrestricted, royalty-free, irrevocable license to use, reproduce, display, perform, modify, transmit, and distribute such ideas in any medium and agree that Medtronic is free to use them for any purpose. In addition, Medtronic has no obligation to provide continued maintenance and support to you in connection with the Licensed Software. Any maintenance and support services provided by Medtronic shall be at Medtronic’s sole discretion.
Limitations of Liability.
THE LICENSED SOFTWARE IS PROVIDED TO YOU “AS IS,” AND MEDTRONIC EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES WITH RESPECT TO THE LICENSED SOFTWARE AND YOUR USE THEREOF, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NONINFRINGEMENT. MEDTRONIC DOES NOT WARRANT THAT THE USE OF THE LICENSED SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE.
Legal Compliance. You shall at all times use the Licensed Software in compliance with all applicable laws. You shall ensure that your installation and use of the Licensed Software complies with all applicable export and import laws, regulations, orders, and policies of the United States of America and any other applicable jurisdiction. You represent and warrant that (i) you are not located in a country that is subject to a U.S. Government embargo, or that has been designated by the U.S. Government as a “terrorist supporting” country, and (ii) you are not listed on any U.S. Government list of prohibited or restricted parties.
Term, Termination, Modifications, and Support. This Agreement shall be in effect from the date when you first install or use the Licensed Software. Medtronic may modify, amend, or terminate this Agreement at any time, including by providing notices or an updated version of this Agreement on a Medtronic website. Medtronic may modify, disable, or terminate your use or Medtronic’s support of the Licensed Software at any time, including by providing notices on a Medtronic website. All obligations which are ongoing in nature shall survive termination or expiration of this Agreement. At any time upon Medtronic’s request (including via a notice on a Medtronic website), you agree to promptly delete and terminate use of any and all copies of the Licensed Software. In addition, upon Medtronic’s request, you agree to provide written verification that you have destroyed all copies of the Licensed Software together with the manner, date, and time of such destruction.
NayaMed International Sárl Customers: Whether the RemoteView feature shall be used in connection with NayaMed customers or devices shall be solely within the discretion of NayaMed International Sárl. If the Licensed Software is used connection with NayaMed customers or devices, this Agreement shall be directly between you and NayaMed with respect to those uses.
Original post date: June 9, 2022
Updated on July 11, 2023: The mitigation section has been changed to reflect that a software update is now available.
The Valleylab™ FT10 energy platform is used in operating rooms to power energy devices that assist healthcare providers1 during surgical procedures. The FT10 has a Covidien label on the top of the generator, as Covidien is owned by Medtronic.
Through routine monitoring, Medtronic identified security vulnerabilities2 in the Data Distribution Service (DDS) software component used in Medtronic’s Valleylab™ FT10 energy platform (all pervious software versions). These vulnerabilities could allow an unauthorized individual, either through a network connection or through physical access to the device, cause the generator to not function. If these vulnerabilities were to be exploited3, the FT10 display would show the “Fail Safe” mode and indicate that the generator is inoperable.
To date, no patient harm, cyberattack or data breach involving a Medtronic product has been observed or associated with this vulnerability.
Medtronic recommends that healthcare providers continue to use these devices as intended.
These vulnerabilities are exploitable if the devices are connected to a network. The FT10 cannot be connected to a network during clinical use and is only connected to a network when actively undergoing system updates or servicing. Therefore, there are no intraoperative safety risks to the patient. Potential patient risk is limited to a minor delay of treatment prior to initiation of surgical procedure while obtaining another device
A software update to address this vulnerability is available as of July 2023. The software update should be applied at the time of servicing to align with how organizations regularly have their FT10 generators maintained. This may be through the hospital’s biomedical engineering team, Medtronic sales or service representative, or by sending the device to a Medtronic service center. Devices can continue to be used until the software update is available. Customers with multiple Valleylab™ generators will need to update each system individually.
In the meantime, the following items are actions that a healthcare organization can take to mitigate the risk of these vulnerabilities:
Customers should contact their local sales representative for additional information.
If you suspect a security issue has occurred with this device or have questions about the future update, please contact Medtronic at email@example.com.
If you have other product security questions, please contact Medtronic’s Product Security Office at firstname.lastname@example.org.
The exposed vulnerability is a memory corruption that can be triggered by sending a malformed network packet to the running DDS application, which requires network connection to the target node. An attack could result in the devices becoming inoperable. This has a CVSS 3.0 score of 5.3 as it is implemented in the FT10 with the previous software versions. The score of 5.3 is the unmitigated score before the patch is applied. The CVE number is CVE-2021-43547.
Disclaimer: This page may include information about products that may not be available in your region or country. Please consult the approved indications for use. Content on specific Medtronic products is not intended for users in markets that do not have authorization for use.