PT-2025-30628 · Medtronic · Mycarelink Patient Monitor 24950+1

Published 2025-07-24 · Updated 2025-08-07 · CVE-2025-4393

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Medtronic MyCareLink Patient Monitor models 24950 and 24952 before June 25, 2025

Description The Medtronic MyCareLink Patient Monitor contains an internal service that deserializes data. A local attacker can interact with this service by crafting a binary payload, potentially leading to a service crash or privilege escalation.

Recommendations Update Medtronic MyCareLink Patient Monitor model 24950 to a version released on or after June 25, 2025. Update Medtronic MyCareLink Patient Monitor model 24952 to a version released on or after June 25, 2025.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-4393

Affected Products

Mycarelink Patient Monitor 24950

Mycarelink Patient Monitor 24952

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-4393 · Security Note
• https://global.medtronic.com/xg-en/product-security/security-bulletins.html · Vendor Advisory
• https://medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-patient-monitor-vulnerabilities.html · Vendor Advisory
• https://cisa.gov/news-events/ics-medical-advisories/icsma-25-205-01 · Note
• https://twitter.com/jmdevlabs/status/1953513113581400351 · Twitter Post
• https://twitter.com/CVEnew/status/1948234096162771045 · Twitter Post