Z-0406-2019Class II

Medtronic CareLink 2090 Programmer

Name: Z-0406-2019 Medtronic CareLink 2090 Programmer
Creator: Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF)
Published: 2018-10-02
License: https://open.fda.gov/license/

Medtronic, Inc. / initiated 2018-10-02 / Open, Classified / root cause: software

FDA source

Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF) began a recall of Medtronic CareLink 2090 Programmer on 2018-10-02. FDA classified it as Class II and gives the reason as "Vulnerabilities have been identified in the SDN download process that may allow an individual with malicious intent to update the programmers with non-Medtronic software during an SDN download". As of 2026-09-10, the recall status on record is Open, Classified, and MDM tags the root cause as software.

Recall record

Recall number: Z-0406-2019
Classification: Class II
Status: Open, Classified
Initiated: 2018-10-02
Posted: 2018-11-08
Recalling firm: Medtronic, Inc.
Product: Medtronic CareLink 2090 Programmer
Product code: OSR Pacemaker/Icd/Crt Non-Implanted Components
Reason for recall: Vulnerabilities have been identified in the SDN download process that may allow an individual with malicious intent to update the programmers with non-Medtronic software during an SDN download.
Root cause tag: software
FDA root cause: Software design
Action: The firm began disseminating the Field Corrective Action notices by hand delivery on 10/02/2018 and followed with the posting of Medtronic Security Bulletin and the Urgent Medical Device Correction customer letter online on 10/11/2018. The notice explained vulnerabilities have been identified in the SDN download process that may allow an individual with malicious intent to update the programmers with non-Medtronic software during an SDN download and beginning October 11th, 2018, Medtronic will be disabling the SDN for programmer updates and will rely solely on the USB update method.
Quantity in commerce: 30172 units
Distribution: Worldwide
Product codes and lots: All Serial Numbers

Enforcement reports

One row per recalled product line

FDA enforcement reports joined to recall event Z-0406-2019
Recall number	Class	Status	Voluntary or mandated	Report date	Classified
Z-0406-2019	Class II	Ongoing	Voluntary: Firm initiated	2018-11-14	2018-11-08
Z-0407-2019	Class II	Ongoing	Voluntary: Firm initiated	2018-11-14	2018-11-08

Product code OSR

The FDA recall record names no cleared device, and no clearance has been matched to it.

MDM coverage of this record lists here, newest first.

About this record

Sourced from the FDA device recall database and the FDA enforcement reports, both ingested from openFDA. The recall record supplies the product, the reason and the product code; the enforcement report supplies the classification. The two datasets are exported by FDA on different days, and the date above is the older of the two, so nothing on this page is newer than it says.

MDM adds the root cause tag, derived from FDA’s own root cause text, and the cross-links to the product code, the clearances named on the record and MDM coverage. Where a recall has not been joined to an enforcement report, no classification is shown.

Data as of 2026-10-07, the FDA export date for this dataset. Page last changed 2026-09-05. View this recall on fda.gov (opens on fda.gov)