PT-2025-30630 · Medtronic · Mycarelink Patient Monitor

CVE-2025-4395 · Published 2025-07-24 · Updated 2025-08-07

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Medtronic MyCareLink Patient Monitor models 24950 and 24952 before June 25, 2025

Description The Medtronic MyCareLink Patient Monitor contains a built-in user account with no password. This allows an attacker with physical access to log in without authentication and modify system functionality.

Recommendations For Medtronic MyCareLink Patient Monitor models 24950 and 24952 before June 25, 2025, change the default password for the built-in user account.

Fix

Weakness Enumeration

CWE-258

Related Identifiers

CVE-2025-4395

Affected Products

Mycarelink Patient Monitor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-4395 · Security Note
• https://global.medtronic.com/xg-en/product-security/security-bulletins.html · Vendor Advisory
• https://medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-patient-monitor-vulnerabilities.html · Vendor Advisory
• https://twitter.com/CVEnew/status/1948234093981745320 · Twitter Post
• https://cisa.gov/news-events/ics-medical-advisories/icsma-25-205-01 · Note
• https://twitter.com/jmdevlabs/status/1953573515619106924 · Twitter Post