medtronic has 5 CVEs on record between 2018 and 2025. The busiest recent month was December 2025 with 4. The median CVSS is 5.2 (medium). None have a confirmed exploitation report. Most affected products: carelink_network (4), mycarelink_24952_patient_monitor_firmware (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.2
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Products
- carelink_network 4
- mycarelink_24952_patient_monitor_firmware 1
Worst active — by depth score
CVE-2025-12995High· 8.1Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances45CVE-2025-12994Medium· 5.3Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account29CVE-2018-10622Medium· 5.2Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format29CVE-2025-12996Medium· 4.1Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances23CVE-2025-12997Low· 2.2Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive…12
medtronic vulnerabilities
CVEs affecting medtronic, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2025-12997Low· 2.2Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive…
Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive…
CVE-2025-12996Medium· 4.1Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances
Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
CVE-2025-12995High· 8.1Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances
Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: be…
CVE-2025-12994Medium· 5.3Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account
Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before Decemb…
CVE-2018-10622Medium· 5.2Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.