You just clicked a link to go to another website. If you continue, you will leave this site and go to a site run by someone else.
It is possible that some of the products on the other site are not approved in your country.
The content on this site may not be allowed under the laws of your country of residence. Please review the applicable healthcare laws in your country. If not allowed, please exit this site. Medtronic declines any liability as to your access to such information.
Click “Continue” to close this window and view the site’s content.
Your browser is out of date
With an updated browser, you will have a better Medtronic website experience. Update my browser now.
Medtronic, Inc. (“Medtronic”) offers RemoteView, which permits a user (“Programmer User”) of the Medtronic CareLink® 2090 Programmer (“Programmer”) to allow the viewing of information presently displayed on the Programmer screen with one or more individuals in remote locations anywhere in the world (“Remote Viewer”), including remote health care professionals or Medtronic representatives.
Limited License Grant. You are hereby granted a nonexclusive, nontransferable, terminable, nonassignable, nonsublicensable, limited license to install and use a copy of the Licensed Software solely for authorized and legitimate purposes. You may not otherwise copy, use, modify, reverse engineer, decompile, disassemble, create derivative works based on, or integrate with other systems or programs the Licensed Software without the prior written consent of Medtronic. You shall have sole responsibility for any fees or charges, including service or data charges, incurred by you in connection with your use of the Licensed Software. You shall not remove any proprietary or other legend or restrictive notice contained or included in the Licensed Software or other documentation associated with such Licensed Software. You agree to maintain any and all copyright, trademark, and other notices on the Licensed Software and any associated documentation.
Licensed Software Functionality and Data Use, Collection, Viewing, and Transfer.
“Active Remote Viewer” as referred to herein shall mean a Remote Viewer that has installed the Licensed Software and has at the relevant point in time an active network connection to a Medtronic server via the Licensed Software.
By installing or using the Licensed Software or clicking any acceptance button in connection with this Agreement, you acknowledge, understand, agree to, and consent to all of the following, including when you are an Active Remoter User:
) Registration. To obtain access to the Licensed Software, you must register at the Medtronic RemoteView website and establish a user name and password. All information that you provide in connection with such registration must be complete, accurate, and truthful. The user name and password are personal to you and must not be shared with anyone else. You will also not attempt, directly or indirectly, to disable, bypass, or defeat any password protection associated with the Licensed Software. Medtronic reserves the right to deny or disable any user name or password or request for any user name or password.
) Your Personal Information. Medtronic will collect information in connection with your registration and installation and use of the Licensed Software, including your first and last name, your email address, a selected security question(s) and your corresponding answer(s), your address, and your telephone number. You agree that Medtronic may store this personal information about you on a Medtronic server, including a server located in the United States of America.
) Session Key. To view the information on the Programmer, the Remote Viewer must generate a Session Key that must be shared with and entered by the Programmer User. “Session Key” as used herein means a unique token active for a limited period of time generated by the Remote Viewer. You agree not to share this Session Key with anyone other than the Programmer User who has initiated the specific session.
) Logging of Session Activity. Each time you log in to the Licensed Software, Medtronic will collect information about your activity, including in an aggregated log or database, regarding you and your session, including your name, username, computer name, IP address, operating system details, and session details (including transferring and sharing activity, start and end times, view only or control activity, and any chat messages between or among any Active Remote Viewers. You agree that Medtronic may store any personal information about you on a Medtronic server, including a server located in the United States of America.
) Active Remote Users. When you are an Active Remote Viewer: (1) you will be able to view the name and/or user name of any other Active Remote Viewer who is logged into the same Medtronic server; and (2) any other Active Remote Viewer who is actively logged into the same Medtronic server will be able to view your name and/or user name. The Licensed Software also permits one Active Remote Viewer to share the information being viewed to any other Active Remote Viewer. You must not share any information from the Medtronic programmer, including with any other Active Remote Viewer, absent the express permission from the Programmer User that is allowing you to view the information.
) Availability. Medtronic has limitations on the number of users that can concurrently log in to the Licensed Software at any given time. Thus, installation of or accessing the Licensed Software does not guarantee that it will be available to you for use at any time.
Permissions. By installing and using the Licensed Software, you represent that you have permission to do so from any associated clinic, hospital, or medical practice and that your use of the Licensed Software complies with any policies or requirements of such associated clinic, hospital, or medical practice. You are also responsible for confirming that the Programmer User has obtained any necessary patient consent before allowing you to view any patient information via the Licensed Software.
Your Acknowledgements. You acknowledge that the Licensed Software is not the exclusive method of viewing information from the Programmer and that the Licensed Software is not the exclusive method by which to obtain a patient’s implanted cardiac device data, including any data on the Programmer. You also acknowledge that the Licensed Software is not intended to be used as a life-sustaining or interventional tool during medical emergencies. You further acknowledge that Medtronic is not, and shall not be deemed to be, a provider of patient health care services by virtue of its provision of access to the Programmer screen information via the Licensed Software. You also acknowledge that information from the Licensed Software is not an electronic medical record and use of the Licensed Software does not in any way relieve you from using your best medical judgment to determine a proper course of treatment for patients.
Security/Privacy of Patient Data. Your use of the Licensed Software and any Session Keys shall be solely for legitimate and lawful purposes and not for any malicious purpose. You are solely responsible for and will use your best efforts in maintaining the confidentiality and security of any copies of the Licensed Software as well as any user name, password credentials, and any Session Keys that can be used in accessing the Licensed Software, a Medtronic server, or any information from a Programmer. You are solely responsible for and will use your best efforts in keeping any patient information you may receive or view in connection with the Licensed Software confidential and secure, and you will not attempt to capture or copy any patient information you view in any electronic or hard copy format without the express permission of the Programmer User. You will be responsible for any obligations or liabilities associated with any lost, stolen, or otherwise compromised patient information.
Reporting Issues and Feedback. You agree that you will report any issues or questions, technical or otherwise, regarding the Licensed Software promptly and directly to Medtronic. If you submit any comments or ideas to Medtronic, in the absence of a separate agreement regarding such submissions, you grant to Medtronic an unrestricted, royalty-free, irrevocable license to use, reproduce, display, perform, modify, transmit, and distribute such ideas in any medium and agree that Medtronic is free to use them for any purpose. In addition, Medtronic has no obligation to provide continued maintenance and support to you in connection with the Licensed Software. Any maintenance and support services provided by Medtronic shall be at Medtronic’s sole discretion.
Limitations of Liability.
THE LICENSED SOFTWARE IS PROVIDED TO YOU “AS IS,” AND MEDTRONIC EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES WITH RESPECT TO THE LICENSED SOFTWARE AND YOUR USE THEREOF, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NONINFRINGEMENT. MEDTRONIC DOES NOT WARRANT THAT THE USE OF THE LICENSED SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE.
Legal Compliance. You shall at all times use the Licensed Software in compliance with all applicable laws. You shall ensure that your installation and use of the Licensed Software complies with all applicable export and import laws, regulations, orders, and policies of the United States of America and any other applicable jurisdiction. You represent and warrant that (i) you are not located in a country that is subject to a U.S. Government embargo, or that has been designated by the U.S. Government as a “terrorist supporting” country, and (ii) you are not listed on any U.S. Government list of prohibited or restricted parties.
Term, Termination, Modifications, and Support. This Agreement shall be in effect from the date when you first install or use the Licensed Software. Medtronic may modify, amend, or terminate this Agreement at any time, including by providing notices or an updated version of this Agreement on a Medtronic website. Medtronic may modify, disable, or terminate your use or Medtronic’s support of the Licensed Software at any time, including by providing notices on a Medtronic website. All obligations which are ongoing in nature shall survive termination or expiration of this Agreement. At any time upon Medtronic’s request (including via a notice on a Medtronic website), you agree to promptly delete and terminate use of any and all copies of the Licensed Software. In addition, upon Medtronic’s request, you agree to provide written verification that you have destroyed all copies of the Licensed Software together with the manner, date, and time of such destruction.
NayaMed International Sárl Customers: Whether the RemoteView feature shall be used in connection with NayaMed customers or devices shall be solely within the discretion of NayaMed International Sárl. If the Licensed Software is used connection with NayaMed customers or devices, this Agreement shall be directly between you and NayaMed with respect to those uses.
September 10, 2020
This Medtronic Security Bulletin is intended to provide product specific cybersecurity information regarding our Medtronic BlueSync™ implantable cardiac devices and the Medtronic CareLink SmartSync™ Device Manager products. This Medtronic Security Bulletin contains a General/High Level Summary, Technical User Information and List of Affected Products relative to our Bluetooth In-Office (BTIO) Security Vulnerability Patch.
Through Medtronic’s proactive internal cybersecurity testing, two cybersecurity vulnerabilities involving the Bluetooth Low Energy (BLE) communication between certain Medtronic BlueSync™ cardiac devices and the Medtronic CareLink SmartSync™ Device Manager were discovered and subsequently remediated.
Both vulnerabilities are the result of potential disruption to the BLE communication session initiation process between the BlueSync cardiac device and the SmartSync Device Manager. They cannot be used to change or modify programming and cannot be used to intercept any information transmitted. Exploitation of these vulnerabilities requires an unauthorized user to stay within normal BLE communication range. Any potential disruption does not persist beyond that range.
Medtronic has addressed and remediated these issues. Medtronic remediations for these internally identified vulnerabilities were included in a routine software update deployed in June 2020. The update remediates and removes these vulnerabilities through improved communication protocols, communication timeouts, and inductive telemetry fallback. The BTIO update is available at your clinician’s office and delivered during device interrogation through their use of the SmartSync programmer. Your clinician will be able to determine if the firmware has been applied by looking at the RAMware ID on their programmer screen.
To date, no cyberattack, no unauthorized access to patient data, and no harm to patients has been observed with these vulnerabilities.
These vulnerabilities do not impact normal therapy delivery or the remote monitoring functionality of the cardiac device.
Medtronic has scored the vulnerabilities using the Common Vulnerability Scoring System (CVSS). This scoring system, which is the standard system used by any entity evaluating a vulnerability, scores vulnerabilities from a 0 (no impact) to a 10 (highest impact).
The Denial of Service Attack(DoS) vulnerability has a CVSS Base Score of 7.1 with an accompanying vector of (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). The “Battery Drain” vulnerability received a CVSS Base Score of 5.1 with an accompanying vector of AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
The Denial of Service Attack(DoS) vulnerability could allow an unauthorized user to prevent a programming communication session initiation between the BlueSync cardiac device and the SmartSync Device Manager by monopolizing the BLE connection during the session initiation process. This communication disruption also interrupts the inductive telemetry communication with the cardiac device, thereby disrupting all communication methods with the cardiac device. All cardiac therapy functions will continue to operate as normal.
The second, related vulnerability identified could allow an unauthorized user to cause unintended cardiac device battery power consumption by monopolizing the BLE connection during the session initiation process and leaving the BLE communication channel open for an extended period longer than 12 hours.
To date, neither a cyberattack nor patient harm has been observed or associated with these vulnerabilities.
These vulnerabilities do not impact normal therapy delivery or the remote monitoring functionality of the cardiac device.
Customers needing additional information should contact firstname.lastname@example.org
|Type of Device||Models|
Azure™ S DR MRI
Cardiac Resynchronization Therapy Pacemaker (CRT-P)
Percepta™ Quad CRT-P MRI
CareLink SmartSync™ Device Manager (Model 24970A)
Patients or clinicians with questions or concerns about these devices should contact:
US: Medtronic Patient and Technical Services is available to answer questions Monday-Friday 7am – 6pm Central Time at 1-800-551-5544 International: Contact your local Medtronic representative.
Disclaimer: This page may include information about products that may not be available in your region or country. Please consult the approved indications for use. Content on specific Medtronic products is not intended for users in markets that do not have authorization for use.