CVE-2017-5149: An issue was discovered in St.

Security readout for executives and security teams

Certain St. Jude Medical Merlin@home transmitters did not verify who they were communicating with online. An attacker positioned between the transmitter and Merlin.net could potentially view or alter that communication. The source bundle does not provide CVSS scoring, confirmed exploitation, or detailed operational impact. Exposure is limited to environments using the listed Merlin@home transmitter models on versions before 8.2.2. The risk depends on whether an attacker can intercept communications between the transmitter and Merlin.net. The bundle does not identify broader product families or unrelated devices. Treat this as a targeted medical-device remote monitoring risk. It deserves prompt inventory and vendor-led remediation where affected transmitters are still deployed, but the provided evidence does not support declaring emergency active exploitation. Mitigation focus: Inventory Merlin@home transmitters and confirm model and installed version.; Update affected transmitters to Version 8.2.2 or later using vendor guidance.; Consult the ICS-CERT advisory for vendor-specific remediation instructions..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.