BaseFortify

Publication date: 2025-12-04

Last updated on: 2025-12-08

Assigner: Medtronic

Description

Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-04

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-12-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12995

Affected Vendors & Products

Vendor	Product	Version / Range
medtronic	carelink_network	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

The vulnerability in Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint. This attack could enable the attacker to determine a valid password under certain circumstances.

Impact Analysis

This vulnerability can lead to unauthorized access by allowing attackers to discover valid passwords through brute force attacks. This could compromise the confidentiality, integrity, and availability of the affected system.

Hi! I’m here to help you understand CVE-2025-12995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70