PT-2025-49125 · Medtronic · Medtronic Carelink Network

Bernhard Lorenz · CVE-2025-12995 · Published 2025-12-04 · Updated 2026-01-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Medtronic CareLink Network versions prior to December 4, 2025

Description The Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint. Successful exploitation could allow an attacker to determine a valid password under certain circumstances. The affected API endpoint is not specified.

Recommendations Versions prior to December 4, 2025 should be updated.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-12995

Affected Products

Medtronic Carelink Network

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12995 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12995 · Vendor Advisory
• https://medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html · Vendor Advisory
• https://twitter.com/SecReportCVE/status/2006810552987746382 · Twitter Post
• https://twitter.com/CVEnew/status/1996682393285968233 · Twitter Post
• https://t.me/cveNotify/146559 · Telegram Post