PT-2025-30629 · Medtronic · Mycarelink Patient Monitor

CVE-2025-4394 · Publicado 2025-07-24 · Atualizado 2025-08-25

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Medtronic MyCareLink Patient Monitor versions 24950 and 24952 before June 25, 2025

Description The Medtronic MyCareLink Patient Monitor utilizes an unencrypted filesystem on its internal storage. This allows an attacker with physical access to read and modify files stored on the device.

Recommendations Ensure that physical access to the Medtronic MyCareLink Patient Monitor models 24950 and 24952 is restricted before June 25, 2025.

Correção

LPE

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2025-4394

Produtos afetados

Mycarelink Patient Monitor

Referências · 9

• https://medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-patient-monitor-vulnerabilities.html · Aviso do Fabricante
• https://cisa.gov/news-events/ics-medical-advisories/icsma-25-205-01 · Nota
• https://twitter.com/wordpressved/status/1959816486299848767 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/1948420229261853095 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-4394 · Nota de Segurança
• https://twitter.com/whatitdohowitdo/status/1951704837336486224 · Publicação no Twitter
• https://global.medtronic.com/xg-en/product-security/security-bulletins.html · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1948234094959001653 · Publicação no Twitter
• https://twitter.com/jmdevlabs/status/1953543314763919446 · Publicação no Twitter