Medium severity · published Jul 24, 2025
CVE-2025-4394
Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files.
This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
MyCareLink Patient Monitor 24950 · Medtronic
before June 25, 2025 · source: vendor
MP
MyCareLink Patient Monitor 24952 · Medtronic
before June 25, 2025 · source: vendor
Affected product
MP
MyCareLink Patient Monitor 24950
Medtronic
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4394
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4394
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-205-01
www.medtronic.com
https://www.medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-patient-monitor-vulnerabilities.html
More from MyCareLink Patient Monitor 24950
6.8
CVE-2025-4397
Medtronic MyCareLink Patient Monitor Data Encryption Weakness
6.8
CVE-2025-4386
Medtronic MyCareLink Patient Monitor Hardware Debug Port
6.8
CVE-2025-4395
Medtronic MyCareLink Patient Monitor Empty Password Vulnerability
6.5
CVE-2025-4393
Medtronic MyCareLink Patient Monitor Deserialization Vulnerability