CVE Program partner

Medtronic

Medtronic

API
CVEs, 365 days612 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationMedtronic
RoleCNA
TypeVendor
Reports toicscert → CISA
ScopeAll products of Medtronic or a Medtronic company including supported products and end-of-life/end-of-service products, as well as vulnerabilities in third-party software discovered in Medtronic products that are not in another CNA’s scope.
Advisorieshttps://global.medtronic.com/xg-en/product-security/security-bulletins.html

Latest CVEs · RSS

  • CVE-2025-4397 2026-05-07 · CVSS 6.8
    Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encry
  • CVE-2025-4386 2026-05-07 · CVSS 6.8
    Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to access a login prompt via a UART termina
  • CVE-2025-12997 2025-12-04 · CVSS 2.2
    Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user info
  • CVE-2025-12996 2025-12-04 · CVSS 4.1
    Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certa
  • CVE-2025-12995 2025-12-04 · CVSS 8.1
    Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid
  • CVE-2025-12994 2025-12-04 · CVSS 5.3
    Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to deter
  • CVE-2025-4395 2025-07-24 · CVSS 6.8
    Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no passwor
  • CVE-2025-4394 2025-07-24 · CVSS 6.8
    Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files.
  • CVE-2025-4393 2025-07-24 · CVSS 6.5
    Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a bi
  • CVE-2023-31222 2023-06-29 · CVSS 9.8
    Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthoriz
  • CVE-2023-25931 2023-03-01 · CVSS 6.4
    Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requir
  • CVE-2022-32537 2022-11-17 · CVSS 4.8
    A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is be

All CVE Program partners