What is CVE-2025-4395?

CVE-2025-4395 is a medium-severity vulnerability in Medtronic Mycarelink Patient Monitor 24950, classified under CWE-258. CVSS score: 6.8/10. Published 2025-07-24.

How severe is CVE-2025-4395?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Medtronic Mycarelink Patient Monitor 24950

CVE-2025-4395

Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025

EPSS: 0.003 (18.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Medtronic Mycarelink Patient Monitor 24950 — versions 0
Medtronic Mycarelink Patient Monitor 24952 — versions 0

Weakness classification (CWE)

CWE-258

References

security@medtronic.com (vendor-advisory)
security@medtronic.com (third-party-advisory)

Frequently asked questions

What is CVE-2025-4395?: CVE-2025-4395 is a medium-severity vulnerability in Medtronic Mycarelink Patient Monitor 24950, classified under CWE-258. CVSS score: 6.8/10. Published 2025-07-24.
How severe is CVE-2025-4395?: Medium severity. CVSS v3 base score is 6.8 out of 10.