Home

Description

Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encrypted drive data.

PUBLISHED Reserved 2025-05-06 | Published 2026-05-07 | Updated 2026-05-07 | Assigner Medtronic




MEDIUM: 6.8CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-313 Cleartext storage in a file or on disk

Product status

Default status
unaffected

Any version before February 25, 2026
affected

Default status
unaffected

Any version before February 25, 2026
affected

Credits

Ethan Morchy, with Somerset Recon finder

Carl Mann, independent researcher finder

Billy Rios, Jesse Young, and Jonathan Butts of Whitescope LLC reported these vulnerabilities finder

References

www.medtronic.com/...nk-patient-monitor-vulnerabilities.html vendor-advisory

www.cisa.gov/...vents/ics-medical-advisories/icsma-25-205-01 third-party-advisory

www.medtronic.com/...curity-bulletins/mycarelink-8-7-18.html vendor-advisory

www.cisa.gov/...vents/ics-medical-advisories/icsma-18-219-01 third-party-advisory

cve.org (CVE-2025-4397)

nvd.nist.gov (CVE-2025-4397)

Download JSON