CVE-2025-12994

Summary

Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025.

Affected Software

Weaknesses

• CWE-204: CWE-204 Observable Response Discrepancy

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html

• ←Previous
• Next→