EUVD-2025-201284Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to CareLink Network
-
DeliveryObtain target device/user identifiers
-
ExploitCraft API request with substituted object reference
-
ExecutionServer returns other user's sensitive data
-
ImpactExfiltrate exposed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Exploitation Conditions | Exploitation requires an authenticated CareLink Network account (PR:L) plus prior possession of a target's 'specific device and user information' to construct the direct object reference - this prerequisite is the primary limiter and drives the high attack complexity (AC:H), making mass or opportunistic exploitation impractical. No user interaction is needed (UI:N) and the endpoint is network-reachable (AV:N), but access is confined to reading sensitive user information (C:L; no integrity or availability impact). The affected product is the Medtronic CareLink Network as it existed before December 4, 2025; because it is a vendor-hosted service, the remediation is applied centrally rather than requiring a client-side configuration change. |
| Impact | This is a genuinely low-priority issue despite being remotely reachable. The CVSS 3.1 base score is 3.1 (LOW) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N: network vector, but high attack complexity and low-privilege authentication are both required, and impact is limited to a partial confidentiality breach (C:L) with no integrity or availability effect. All exploitation signals reinforce low real-world risk: EPSS is only 0.04% (10th percentile), there is no CISA KEV listing, and no public exploit code was identified. The high AC reflects the description's requirement that the attacker already possess 'specific device and user information' to enumerate/manipulate the object reference, which meaningfully limits opportunistic mass exploitation. This is a classic IDOR (CWE-639) that leaks sensitive user information rather than granting control - a targeted privacy/data-exposure concern in a healthcare context, not a widespread emergency. No signals conflict: low CVSS, low EPSS, no KEV, and no POC all agree. The one caveat is the sensitivity of the data (patient/medical-device information under a healthcare provider), which raises regulatory and privacy stakes even though the technical severity is low. |
| Exploit ScenarioDerived | An authenticated CareLink Network user who already knows another patient's specific device and user identifiers crafts web requests to an API endpoint, substituting those identifiers to retrieve sensitive user information belonging to another account. No public proof-of-concept exists, and the required prior knowledge of valid device/user details plus authentication keeps this a targeted rather than opportunistic attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 26, 2026
Sensitive user information held by the Medtronic CareLink Network can be read by an authenticated attacker who already possesses a target's specific device and user details and who crafts direct object reference requests against a CareLink API endpoint; the affected service is CareLink Network as it existed before December 4, 2025. Exploitation requires a valid CareLink account (PR:L) plus pre-obtained knowledge of the target's identifiers, which is what drives the high attack complexity (AC:H) and makes broad or opportunistic abuse impractical - the outcome is limited to information disclosure (C:L) with no integrity or availability impact. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the EPSS score is 0.04% (10th percentile), consistent with a genuinely low-priority issue.
Earlier versions of this analysis (1)
RemediationAI
Remediation for CVE-2025-12997 is vendor-side: Medtronic addressed the vulnerable API endpoint in the CareLink Network service update dated December 4, 2025, so no customer-installable patch exists and no action is required to obtain the code fix beyond confirming that the service you use reflects the post-December 4, 2025 state described in the advisory at https://www.medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html. Because the fix is applied centrally, the practical controls available to account holders are compensating ones: enforce unique strong credentials and multi-factor authentication on every CareLink account, review and prune clinician and caregiver access grants so that as few principals as possible hold the low-privileged sessions the attack requires, and limit the distribution of device serial numbers, patient identifiers and other "specific device and user information" that the IDOR lookup depends on, since wider sharing of those identifiers lowers the effective attack complexity. Additional low-cost measures include monitoring CareLink account audit logs and login history for unexpected queries or access from unfamiliar IP addresses, and promptly reporting suspected data exposure to Medtronic product security (security@medtronic.com); the trade-off of tightening sharing and access grants is reduced convenience for caregivers and support staff who rely on open identifier exchange, but given the low severity (CVSS 3.1, confidentiality-only) and the absence of public exploit code or confirmed active exploitation, these steps remain proportionate rather than urgent.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic Insecure Direct Object Reference (CWE-639) in a web-exposed API served by Medtronic's CareLink Network, a cloud platform used by patients and clinicians to upload, view and manage data from implantable cardiac devices and glucose monitors. The flaw class arises when an API endpoint accepts a client-supplied identifier (for example a device serial, patient record key or user ID) and returns the associated object without verifying that the requesting principal is authorized for that object, so an authenticated user can substitute another party's identifier to retrieve data they should not see. The CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the endpoint is network-reachable over the internet, demands a low-privileged authenticated session, requires no victim interaction, and is scoped to the vulnerable component with confidentiality-only impact. The CPE cpe:2.3:a:medtronic:carelink_network:*:*:*:*:*:*:*:* matches all versions of the hosted CareLink Network prior to the December 4, 2025 service update, and because CareLink is a vendor-operated cloud service rather than installable software, the fix is deployed centrally by Medtronic and cannot be applied by end users.
Know when Carelink Network gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Authenticated low-priv user (PR:L) needs specific victim device/user data to forge the reference (AC:H); IDOR leaks limited data (C:L) with no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network: before December 4, 2025.
Executive ViewAI
CVE-2025-12997 is a low-severity vulnerability (CVSS 2.2). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Carelink Network
View allUnauthenticated brute-force attacks against the Medtronic CareLink Network API authentication endpoint can allow remote
A security vulnerability in Medtronic CareLink Network (CVSS 5.3) that allows an unauthenticated remote attacker. Remedi
Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext
GitHub PoC
Exploit-DB