CVE-2025-12994
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025.
Risk Assessment
An attacker can enumerate user accounts, facilitating further targeted attacks such as phishing or brute force.
Recommendation
Apply the fixes provided by Medtronic for CareLink Network after December 4, 2025, and monitor for unusual requests to the security questions API endpoint.
Other vulnerabilities in Medtronic CareLink Network
Original NVD description (English source)
Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS