What is the CVSS score of CVE-2025-12996?

CVE-2025-12996 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Carelink Network are affected by CVE-2025-12996?

Organizations using Medtronic CareLink Network should be aware of moderate risk from CVE-2025-12996, a log file exposure vulnerability rated CVSS 4.1. This could allow unauthorized file access.

How to fix or mitigate CVE-2025-12996?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Carelink Network CVE-2025-12996

EUVD-2025-201287 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2025-12-04 security@medtronic.com

Information Disclosure Carelink Network

4.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.1 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201287

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 20:16 nvd

MEDIUM 4.1

DescriptionCVE.org

Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This issue affects CareLink Network: before December 4, 2025.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Insertion of Sensitive Information into Log File (CWE-532).