Medtronic
35 CVEs across 264 Medtronic products. Browse Medtronic vulnerabilities, severities, and proof-of-concept exploits.
Medtronic products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4397 | Medium | 6.8 | 2026-05-07 | Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encr… |
CVE-2025-4386 | Medium | 6.8 | 2026-05-07 | Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to access a login prompt via a UART termin… |
CVE-2025-12997 | Low | 2.2 | 2025-12-04 | Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user inf… |
CVE-2025-12996 | Medium | 4.1 | 2025-12-04 | Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under cert… |
CVE-2025-12995 | High | 8.1 | 2025-12-04 | Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid… |
CVE-2025-12994 | Medium | 5.3 | 2025-12-04 | Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to dete… |
CVE-2025-4395 | Medium | 6.8 | 2025-07-24 | Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no passwo… |
CVE-2025-4394 | Medium | 6.8 | 2025-07-24 | Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files… |
CVE-2025-4393 | Medium | 6.5 | 2025-07-24 | Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a b… |
CVE-2023-31222 | Critical | 9.8 | 2023-06-29 | Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthori… |
CVE-2023-25931 | Medium | 6.4 | 2023-03-01 | Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requi… |
CVE-2022-32537 | Medium | 4.8 | 2022-12-12 | A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is b… |
CVE-2020-27252 | High | 8.8 | 2020-12-14 | Medtronic MyCareLink Smart 25000 is vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to… |
CVE-2020-25187 | High | 8.8 | 2020-12-14 | Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap… |
CVE-2020-25183 | High | 8.0 | 2020-12-14 | Medtronic MyCareLink Smart 25000 contains an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader… |
CVE-2019-13543 | Medium | 5.8 | 2019-11-08 | Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energ… |
CVE-2019-13539 | High | 7.0 | 2019-11-08 | Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energ… |
CVE-2019-13535 | Medium | 4.6 | 2019-11-08 | In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not… |
CVE-2019-13531 | Medium | 4.8 | 2019-11-08 | In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not… |
CVE-2019-10964 | High | 7.1 | 2019-06-28 | Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters… |
CVE-2019-6540 | Medium | 6.5 | 2019-03-26 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer… |
CVE-2019-6538 | Critical | 9.3 | 2019-03-25 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer… |
CVE-2018-18984 | Medium | 4.6 | 2018-12-14 | Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest . |
CVE-2018-14781 | Medium | 5.3 | 2018-08-13 | Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerab… |
CVE-2018-10634 | Medium | 4.8 | 2018-08-13 | Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker could capture these t… |
CVE-2018-10626 | Medium | 4.4 | 2018-08-10 | Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product… |
CVE-2018-10622 | Medium | 5.2 | 2018-08-10 | Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network au… |
CVE-2018-10631 | Medium | 6.3 | 2018-07-13 | The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 Application Card and… |
CVE-2018-8870 | Medium | 6.4 | 2018-07-03 | Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove th… |
CVE-2018-8868 | Medium | 6.2 | 2018-07-03 | Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces… |
CVE-2018-10596 | High | 7.1 | 2018-07-03 | Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this v… |
CVE-2018-8849 | Medium | 4.6 | 2018-05-18 | Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest. |
CVE-2018-5448 | Medium | 4.8 | 2018-05-04 | Medtronic 2090 CareLink Programmer’s software deployment network contains a directory traversal vulnerability that could allow an attacker to read files on the… |
CVE-2018-5446 | Medium | 4.9 | 2018-05-04 | Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format. |
CVE-2011-3386 | | 2011-09-02 | Unspecified vulnerability in Medtronic Paradigm wireless insulin pump 512, 522, 712, and 722 allows remote attackers to modify the delivery of an insulin bolus… |