PT-2025-30629 · Medtronic · Mycarelink Patient Monitor

Published 2025-07-24 · Updated 2025-08-25 · CVE-2025-4394

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Medtronic MyCareLink Patient Monitor versions 24950 and 24952 before June 25, 2025

Description The Medtronic MyCareLink Patient Monitor utilizes an unencrypted filesystem on its internal storage. This allows an attacker with physical access to read and modify files stored on the device.

Recommendations Ensure that physical access to the Medtronic MyCareLink Patient Monitor models 24950 and 24952 is restricted before June 25, 2025.

Fix

LPE

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2025-4394

Affected Products

Mycarelink Patient Monitor

References · 9

• https://medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-patient-monitor-vulnerabilities.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4394 · Security Note
• https://global.medtronic.com/xg-en/product-security/security-bulletins.html · Vendor Advisory
• https://cisa.gov/news-events/ics-medical-advisories/icsma-25-205-01 · Note
• https://twitter.com/wordpressved/status/1959816486299848767 · Twitter Post
• https://twitter.com/0dayPublishing/status/1948420229261853095 · Twitter Post
• https://twitter.com/whatitdohowitdo/status/1951704837336486224 · Twitter Post
• https://twitter.com/CVEnew/status/1948234094959001653 · Twitter Post
• https://twitter.com/jmdevlabs/status/1953543314763919446 · Twitter Post