Vendor
Medtronic
34 known vulnerabilities.
Medtronic at a glance
- Last 12 months
- 6
- Critical · all time
- 2
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 2 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 4 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 3 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
Medium max 5.2
Medtronic MyCareLink 24950 Patient Monitor (Update A)
Successful exploitation of these vulnerabilities may allow an attacker with physical access to obtain per-product credentials that are utilized to authenticate data uploads and encrypt data at rest. Additionally, an attacker with access to a set of these cred…
first Aug 7, 2018 -
Medium max 6.8
Medtronic MyCareLink Patient Monitor (Update A)
Successful exploitation of these vulnerabilities could lead to system compromise, unauthorized access to sensitive data, and manipulation of the monitor's functionality.
first Jul 24, 2025 -
Critical max 9.8ICSMA-23-180-01 1 CVE
Medtronic Paceart Optima System
Successful exploitation of this vulnerability could result in remote code execution or a denial-of-service condition impacting a healthcare delivery organization's Paceart Optima system.
-
Medium max 6.4ICSMA-23-061-01 1 CVE
Medtronic Micro Clinician and InterStim Apps
Successful exploitation of this vulnerability could cause the clinician application’s custom password to be reset to default, resulting in unauthorized control of the clinician therapy application.
-
Medium max 4.8ICSMA-22-263-01 1 CVE
Medtronic NGP 600 Series Insulin Pumps
Successful exploitation of this vulnerability could allow an unauthorized user to deliver too much or too little insulin through delivery of an unintended insulin bolus or because insulin delivery is slowed or stopped.
34 results · Feed
-
Medium 6.8
Medtronic MyCareLink Patient Monitor Data Encryption Weakness
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encrypted drive data.
-
Medium 6.8
Medtronic MyCareLink Patient Monitor Hardware Debug Port
Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to access a login prompt via a UART terminal.
-
Low 2.2
Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker wit…
-
Medium 4.1
Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext…
-
High 8.1
Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint…
-
Medium 5.3
Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an…
-
Medium 6.8
Medtronic MyCareLink Patient Monitor Empty Password Vulnerability
Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. This issue affects MyCareLink Patient Monitor models 2495…
-
Medium 6.8
Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability
Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025
-
Medium 6.5
Medtronic MyCareLink Patient Monitor Deserialization Vulnerability
Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a binary payload to crash the service or elevate privileges. This issue affects MyCareLink Patient Moni…
-
Critical 9.8CVE-2023-31222 EPSS 28%
Medtronic Paceart MSMQ Deserialization of Untrusted Data
Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorized user to impact a healthcare delivery organization’s Paceart Optima system cardiac device causing…
-
Medium 6.4
Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue
Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the c…
-
Medium 4.8
Medtronic MiniMed 600 Series Pump System Communication Issue
A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is being paired with other system components. Exploitation requires nearby wireless signal proximity wit…
-
High 8.8
Medtronic MyCareLink Smart Time-of-check Time-of-use Race Condition
Medtronic MyCareLink Smart 25000 is vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited, an attacker could remotely execute code …
-
High 8.8
Medtronic MyCareLink Smart Heap-based Buffer Overflow
Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event within the MCL Smart Patient Reader software stack. The heap overflow could allow an a…
-
High 8.0
Medtronic MyCareLink Smart Improper Authentication
Medtronic MyCareLink Smart 25000 contains an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader and the Medtronic MyCareLink Smart mobile app is vulnerable to bypass. This vulnerability enables an …
-
Medium 4.8
Medtronic Valleylab FT10 and LS10 Improper Authentication
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism used for authe…
-
Medium 4.6
Medtronic Valleylab FT10 and LS10 Protection Mechanism Failure
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism does not apply…
-
High 7.0
Medtronic Valleylab FT10 and FX8 Reversible One-way Hash
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password ha…
-
Medium 5.8
Medtronic Valleylab FT10 and FX8 Use of Hard-coded Credentials
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use multiple sets of hard-coded credentials. …
-
High 7.1
Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control
Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authen…
-
Medium 6.5
Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera …
-
Critical 9.3
Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera …
-
Medium 4.6
Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data
Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest .
-
Medium 4.8
Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Cleartext Transmission of Sensitive Information
Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker could capture these transmissions and extract sensitive information, such as device serial numbers.
-
Medium 5.3
Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay
Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote c…
-
Medium 4.4
Medtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload…
-
Medium 5.2
Medtronic MyCareLink Patient Monitor Network Credential Weakness
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.
-
Medium 6.3
Medtronic N'Vision Clinician Programmer Protection Mechanism Failure
The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 Application Card and sufficient technical capability can modify the contents of this card, including the binary executab…
-
Medium 6.2
Medtronic MyCareLink Patient Monitor Exposed Dangerous Method or Function
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physica…
-
Medium 6.4
Medtronic MyCareLink Patient Monitor Use of Hard-coded Password
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove the case of the device, connect to the debug port, and use the password to gain privileged access to t…
-
High 7.1
Medtronic 2090 Carelink Programmer Improper Restriction of Communication Channel to Intended Endpoints
Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this virtual private network before downloading updates. The affected products initially establish an encaps…
-
Medium 4.6
Medtronic N'Vision Clinician Programmer Missing Encryption of Sensitive Data
Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest.
-
Medium 4.9
Medtronic 2090 Carelink Programmer Storing Passwords in a Recoverable Format
Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format.
-
Medium 4.8
Medtronic 2090 Carelink Programmer Relative Path Traversal
Medtronic 2090 CareLink Programmer’s software deployment network contains a directory traversal vulnerability that could allow an attacker to read files on the system.