Read the docs
TI-2025-03922 Aliases CVE-2025-4395GHSA-rxfj-gvqj-6mmm

Medtronic MyCareLink Patient Monitor Empty Password Vulnerability

Priority LOW 32CWE-258Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix Fixed MyCareLink Patient Monitor 24950 (Medtronic): June 25, 2025MyCareLink Patient Monitor 24952 (Medtronic): June 25, 2025

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MedtronicMyCareLink Patient Monitor 24950before June 25, 2025June 25, 2025Patch availableCNA
MedtronicMyCareLink Patient Monitor 24952before June 25, 2025June 25, 2025Patch availableCNA
  • MyCareLink Patient Monitor 24950 VendorMedtronic Affected before June 25, 2025 Fixed in June 25, 2025 Patch available CNA
  • MyCareLink Patient Monitor 24952 VendorMedtronic Affected before June 25, 2025 Fixed in June 25, 2025 Patch available CNA

Remediation

  • Fix · CNA MyCareLink Patient Monitor 24950 (Medtronic) Fixed in June 25, 2025
  • Fix · CNA MyCareLink Patient Monitor 24952 (Medtronic) Fixed in June 25, 2025

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Medtronic MyCareLink Patient Monitor 24950, MyCareLink Patient Monitor 24952 June 25, 2025

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2025-03921 Medtronic MyCareLink Patient Monitor Unencrypted Filesystem VulnerabilityPriority LOW 31
    • TI-2025-03920 Medtronic MyCareLink Patient Monitor Deserialization VulnerabilityPriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4395
  2. 2026-10-03 Alias added: GHSA-rxfj-gvqj-6mmm

References

Advisory 2

  • TI-2023-14928 Medtronic Paceart MSMQ Deserialization of Untrusted Data CVSS 3.1CRITICAL 9.8
  • TI-2020-15429 Medtronic MyCareLink Smart Heap-based Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2020-16578 Medtronic MyCareLink Smart Time-of-check Time-of-use Race Condition CVSS 3.1HIGH 8.8
  • TI-2025-11897 Missing brute-force protection in Medtronic CareLink Network CVSS 3.1CRITICAL 9.8
  • TI-2019-04592 Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control CVSS 3.1CRITICAL 9.3
  • TI-2020-15425 Medtronic MyCareLink Smart Improper Authentication CVSS 3.1HIGH 8.8
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences