Medtronic MyCareLink Patient Monitor CVE-2025-4397

Physical access to the MyCareLink Patient Monitor device or its encrypted storage drive is required to extract credentials. The vulnerability does not require network access, authentication, or user interaction on the device itself. Exploitation is limited to attackers capable of disassembling the device, accessing internal storage, or obtaining a removed drive. The credential storage format (recoverable, not properly hashed) is the enabling vulnerability-credentials are not protected by secure key storage mechanisms (e.g., TPM, secure enclave) and can be extracted from plaintext, weakly obfuscated, or hardcoded-key-encrypted storage.

The CVSS score of 6.8 reflects a medium-to-high severity vulnerability with a critical constraint: physical access (AV:P) is mandatory. The CVSS vector (PR:N/UI:N/S:U/C:H/I:H/A:H) confirms no authentication or user interaction is required once an attacker has physical possession of the device, but the physical attack vector significantly limits the pool of potential attackers compared to a networked vulnerability. In a healthcare setting, physical access risk varies by deployment: devices in unsecured storage, loan closets, or returned-for-service units face greater exposure than those continuously monitored in patient rooms. The information disclosure and data integrity tags confirm this is a confidentiality and integrity issue-patient monitoring data and medical records on the encrypted drive can be viewed, modified, or deleted. KEV status is not confirmed from input data; no public exploit code availability is noted. Real-world risk depends heavily on device placement and physical security controls; a hospital with strict device custody and decommissioning procedures faces lower risk than one with looser physical access controls. The vulnerability is most critical during device lifecycle transitions (repair, refurbishment, disposal) when credentials could be extracted for unauthorized access to patient data.

An attacker with physical access to a MyCareLink Patient Monitor (e.g., during a repair, storage period, or device return) disassembles the device or removes the encrypted storage drive. The attacker extracts the recoverable per-product credentials from device firmware or configuration storage, then uses those credentials to decrypt and access patient data stored on the drive. No authentication is needed once credentials are recovered; the attacker can modify or exfiltrate sensitive medical records without authorization.