CVE-2025-4386: medium-severity vulnerability in Medtronic MyCareLink Patient Monitor 24950
Medtronic MyCareLink Patient Monitor Hardware Debug Port
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The Medtronic MyCareLink Patient Monitor has an exposed serial debug port that can be accessed physically, allowing an attacker to reach a login prompt without authentication. This could enable unauthorized access to sensitive patient monitoring data or device functions.
A UART serial interface on the Medtronic MyCareLink Patient Monitor exposes an unauthenticated login prompt to an attacker with physical access to the device. The vulnerability requires physical proximity but bypasses standard authentication mechanisms, potentially allowing administrative access or configuration changes to a critical medical device.
In the same product, most dangerous first.