Read the docs
TI-2025-03921 Aliases CVE-2025-4394GHSA-99gr-q2p8-x55m

Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability

Priority LOW 31CWE-312Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-312.

Summary

Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00215 11th percentileScored 2026-11-08
Fix Fixed MyCareLink Patient Monitor 24950 (Medtronic): June 25, 2025MyCareLink Patient Monitor 24952 (Medtronic): June 25, 2025

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MedtronicMyCareLink Patient Monitor 24950before June 25, 2025June 25, 2025Patch availableCNA
MedtronicMyCareLink Patient Monitor 24952before June 25, 2025June 25, 2025Patch availableCNA
  • MyCareLink Patient Monitor 24950 VendorMedtronic Affected before June 25, 2025 Fixed in June 25, 2025 Patch available CNA
  • MyCareLink Patient Monitor 24952 VendorMedtronic Affected before June 25, 2025 Fixed in June 25, 2025 Patch available CNA

Remediation

  • Fix · CNA MyCareLink Patient Monitor 24950 (Medtronic) Fixed in June 25, 2025
  • Fix · CNA MyCareLink Patient Monitor 24952 (Medtronic) Fixed in June 25, 2025

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Medtronic MyCareLink Patient Monitor 24950, MyCareLink Patient Monitor 24952 June 25, 2025

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2025-03922 Medtronic MyCareLink Patient Monitor Empty Password VulnerabilityPriority LOW 32
    • TI-2025-03920 Medtronic MyCareLink Patient Monitor Deserialization VulnerabilityPriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4394
  2. 2026-10-03 Alias added: GHSA-99gr-q2p8-x55m

References

Advisory 2

  • TI-2023-14928 Medtronic Paceart MSMQ Deserialization of Untrusted Data CVSS 3.1CRITICAL 9.8
  • TI-2020-15429 Medtronic MyCareLink Smart Heap-based Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2020-16578 Medtronic MyCareLink Smart Time-of-check Time-of-use Race Condition CVSS 3.1HIGH 8.8
  • TI-2025-11897 Missing brute-force protection in Medtronic CareLink Network CVSS 3.1CRITICAL 9.8
  • TI-2019-04592 Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control CVSS 3.1CRITICAL 9.3
  • TI-2020-15425 Medtronic MyCareLink Smart Improper Authentication CVSS 3.1HIGH 8.8
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences