CVE-2025-4397 Medtronic CVE debrief

Who should care

Patients using Medtronic MyCareLink Patient Monitor models 24950 and 24952, clinicians who prescribe or support them, biomedical/clinical engineering teams, and healthcare IT or security staff responsible for remote patient monitoring.

Technical summary

The advisory describes per-product credentials that are stored in a recoverable format on Medtronic MyCareLink Patient Monitor devices. CISA states an attacker would need to physically tamper with the monitor to exploit the issue, and that the credentials could then be used to modify encrypted drive data. The published CVSS vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H, which aligns with the reported CVSS 6.5 MEDIUM rating.

Defensive priority

Medium. The issue is described as a low-risk finding and requires physical tampering, but it affects a medical device and has integrity impact. Prioritize confirmation that affected monitors can receive the vendor update and that custody and distribution practices are controlled.

Recommended defensive actions

• Ensure the remote monitor is plugged in and connected to the internet so the automatic security update process can run.
• Maintain possession of the home monitor and prevent unauthorized physical access or tampering.
• Use only home monitors provided directly by a healthcare provider or a Medtronic representative.
• Contact [email protected] if additional assistance is needed.
• Review Medtronic's security bulletin for product-specific guidance.
• Follow CISA guidance on securing the Internet of Things.
• Follow CISA home network security guidance.

Evidence notes

CISA’s CSAF advisory ICSMA-25-205-01 for CVE-2025-4397 was initially published on 2025-07-24 and revised as Update A on 2026-05-07. The source names affected products as MyCareLink Patient Monitor model 24950 and model 24952, and states that per-product credentials are stored in a recoverable format. It also says an attacker can use those credentials to modify encrypted drive data, and that exploitation would require physical tampering with the monitor. The remediation text says Medtronic began deploying security updates in June 2025 and that updates are applied automatically when the monitor is connected to the internet.

Official resources