CVE-2017-5149

CVE-2017-5149 is a man-in-the-middle vulnerability affecting St. Jude Medical Merlin@home devices (models EX1100 and EX1150) running firmware versions prior to 8.2.2. The flaw stems from a lack of endpoint identity verification during communication between the transmitter and Merlin.net, allowing an attacker to intercept or manipulate data. With a CVSS score of 8.9 (High), this vulnerability is remotely exploitable with high impact on confidentiality, integrity, and availability, though it requires high attack complexity. There is no evidence of active exploitation, public exploit code, or inclusion in CISA's KEV catalog, and community discussion and media coverage are minimal.