CVE-2025-12995
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
Risk Assessment
This could lead to unauthorized access to user accounts, resulting in a breach of medical data confidentiality.
Recommendation
Ensure CareLink Network is updated to a version containing fixes released after December 4, 2025, and implement mechanisms to mitigate brute force attempts.
Other vulnerabilities in Medtronic CareLink Network
Original NVD description (English source)
Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS