Medium severity · published Jul 24, 2025
CVE-2025-4395
Medtronic MyCareLink Patient Monitor Empty Password Vulnerability
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality.
This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
MyCareLink Patient Monitor 24950 · Medtronic
before June 25, 2025 · source: vendor
MP
MyCareLink Patient Monitor 24952 · Medtronic
before June 25, 2025 · source: vendor
Affected product
MP
MyCareLink Patient Monitor 24950
Medtronic
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4395
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4395
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-205-01
www.medtronic.com
https://www.medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-patient-monitor-vulnerabilities.html
More from MyCareLink Patient Monitor 24950
6.8
CVE-2025-4397
Medtronic MyCareLink Patient Monitor Data Encryption Weakness
6.8
CVE-2025-4386
Medtronic MyCareLink Patient Monitor Hardware Debug Port
6.8
CVE-2025-4394
Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability
6.5
CVE-2025-4393
Medtronic MyCareLink Patient Monitor Deserialization Vulnerability