Bernhard Lorenz

SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized attacker to access any space managed by the affected product.

**Name of the Vulnerable Software and Affected Versions** Medtronic CareLink Network versions prior to December 4, 2025 **Description** An unauthenticated remote attacker can send a request to an API endpoint to obtain security questions. This could potentially reveal valid user accounts. **Recommendations** Update Medtronic CareLink Network to a version released on or after December 4, 2025.

**Name of the Vulnerable Software and Affected Versions** Medtronic CareLink Network versions prior to December 4, 2025 **Description** The Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint. Successful exploitation could allow an attacker to determine a valid password under certain circumstances. The affected API endpoint is not specified. **Recommendations** Versions prior to December 4, 2025 should be updated.

Name of the Vulnerable Software and Affected Versions: syngo.plaza VB30E versions prior to VB30E HF05 Description: The issue is related to the lack of protection of the SQL query structure, allowing an attacker to execute arbitrary SQL code and compromise the database. The affected application does not properly sanitize input data before sending it to the SQL server. This could allow an attacker with access to the application to use this vulnerability to execute malicious SQL commands and compromise the whole database. Recommendations: For syngo.plaza VB30E versions prior to VB30E HF05, update to VB30E HF05 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL server to minimize the risk of exploitation. Avoid using unsanitized input data in SQL queries until the issue is resolved.