BaseFortify

Publication date: 2025-12-04

Last updated on: 2025-12-08

Assigner: Medtronic

Description

Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-04

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-12-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12994

Affected Vendors & Products

Vendor	Product	Version / Range
medtronic	carelink_network	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

The vulnerability in Medtronic CareLink Network allows an unauthenticated remote attacker to send requests to an API endpoint that triggers security questions. This can be exploited to determine whether a user account is valid, potentially exposing user account information without authentication.

Impact Analysis

This vulnerability can impact you by allowing attackers to identify valid user accounts on the CareLink Network without needing to authenticate. This could lead to targeted attacks such as phishing or further attempts to compromise user accounts.

Hi! I’m here to help you understand CVE-2025-12994. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70