What’s Vulnerable › Vulnerabilities

CVE-2025-4395: Medtronic MyCareLink Patient Monitor Empty Password Vulnerability

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-24 · updated 2026-06-17
• Weakness: CWE-258

Description

Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025

Affected products

• Medtronic MyCareLink Patient Monitor 24950: before June 25, 2025 — fixed in 2025, June 25
• Medtronic MyCareLink Patient Monitor 24952: before June 25, 2025 — fixed in 2025, June 25

How to fix

Upgrade to a fixed version: Medtronic MyCareLink Patient Monitor 24950 2025, June 25; Medtronic MyCareLink Patient Monitor 24952 2025, June 25. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-205-01
• https://www.medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-patient-monitor-vulnerabilities.html

Get alerted when CVE-2025-4395 or the next vulnerability affects your stack