« Volver al listado

CVE-2025-4397

Estado: Pendiente de análisisMedia (6.8)—

Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encrypted drive data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Medtronic — Mycarelinkpatient MonitorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-4397",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-4397",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-07T15:45:00.819845Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@medtronic.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@medtronic.com",
      "affectedData": [
        {
          "vendor": "Medtronic",
          "product": "MyCareLink Patient Monitor 24950",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "February 25, 2026",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Medtronic",
          "product": "MyCareLink Patient Monitor 24952",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "February 25, 2026",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-05-07T16:16:17.410",
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-219-01",
      "source": "security@medtronic.com"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-205-01",
      "source": "security@medtronic.com"
    },
    {
      "url": "https://www.medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-8-7-18.html",
      "source": "security@medtronic.com"
    },
    {
      "url": "https://www.medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-patient-monitor-vulnerabilities.html",
      "source": "security@medtronic.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@medtronic.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-313"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encrypted drive data."
    }
  ],
  "lastModified": "2026-06-17T09:33:11.150",
  "sourceIdentifier": "security@medtronic.com"
}