BaseFortify

Publication date: 2025-12-04

Last updated on: 2025-12-08

Assigner: Medtronic

Description

Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network: before December 4, 2025.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-04

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-12-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12997

Affected Vendors & Products

Vendor	Product	Version / Range
medtronic	carelink_network	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Medtronic CareLink Network. It allows an authenticated attacker who has access to specific device and user information to send web requests to an API endpoint that can expose sensitive user information.

Impact Analysis

The vulnerability can lead to exposure of sensitive user information if an attacker with certain access submits crafted requests to the API. This could compromise user privacy and potentially lead to misuse of personal data.

Hi! I’m here to help you understand CVE-2025-12997. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70