CVE-2025-4397
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encrypted drive data.
Risk Assessment
A person with access to the credentials can modify encrypted drive data, leading to a data integrity compromise. This may affect the security and reliability of the patient monitor.
Recommendation
Contact Medtronic for guidance on securing credentials and applying updates. Restrict physical and network access to the device.
Other vulnerabilities in Medtronic MyCareLink Patient Monitor
See all- CVE-2025-4386Medium
Medtronic MyCareLink Patient Monitor has an internal serial interface that allows an attacker with physical access to reach a login prompt via a UART terminal. The vulnerability requires physical access to the device.
- CVE-2018-10622Medium
The Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.
Original NVD description (English source)
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encrypted drive data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS