CVE-2025-12994
BaseFortify
Publication date: 2025-12-04
Last updated on: 2025-12-08
Assigner: Medtronic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| medtronic | carelink_network | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-204 | The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Medtronic CareLink Network allows an unauthenticated remote attacker to send requests to an API endpoint that triggers security questions. This can be exploited to determine whether a user account is valid, potentially exposing user account information without authentication.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to identify valid user accounts on the CareLink Network without needing to authenticate. This could lead to targeted attacks such as phishing or further attempts to compromise user accounts.