CVE-2025-4395: Medtronic MyCareLink Patient Monitor Built-In Account Has an Empty Password

CVE-2025-4395 is a hard-coded, empty-credential vulnerability in Medtronic's MyCareLink Patient Monitor, a home device that relays data from a patient's implanted pacemaker, defibrillator or other cardiac device to their clinic: the monitor ships with a built-in user account that has no password, so anyone with physical access to the unit can log in without entering any credentials and modify its system functionality, and NVD has not yet published its own Primary CVSS score, so this page does not present a headline severity figure as NVD-confirmed.

CVE-2025-4395 (use of a hard-coded, empty password) affects Medtronic's MyCareLink Patient Monitor models 24950 and 24952 — a home bedside device that cardiac patients use to automatically relay data from an implanted pacemaker, implantable cardioverter-defibrillator (ICD) or cardiac resynchronization device to their clinic between in-person visits. NVD's description states: "Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025" (NVD).

NVD tracks CVE-2025-4395 with status "Deferred": it records only a Medtronic-submitted Secondary score (source [email protected]) of CVSS v3.1 6.8 (medium), vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — not NVD's own Primary rating — so this page does not present a headline figure as NVD-confirmed (NVD).

CISA's advisory ICSMA-25-205-01 bundles this empty-password flaw with several related MyCareLink issues disclosed the same week — an internal service that deserializes untrusted data (CVE-2025-4393), an unencrypted internal filesystem (CVE-2025-4394), an exposed UART serial login prompt (CVE-2025-4386), and per-product credentials stored in recoverable form (CVE-2025-4397) — and states that successful exploitation of the set "could lead to system compromise, unauthorized access to sensitive data, and manipulation of the monitor's functionality," while noting all of them require physical tampering with the monitor itself, not the implanted cardiac device (CISA ICS Medical Advisory ICSMA-25-205-01).

CISA lists the Healthcare and Public Health sector, worldwide deployment and an Ireland-headquartered vendor, and credits researchers Ethan Morchy of Somerset Recon, Carl Mann, and an independent researcher with reporting the issues (CISA ICS Medical Advisory ICSMA-25-205-01).

Medtronic's remediation, per CISA's advisory, is an automatic security update it began deploying to in-use MyCareLink Patient Monitors in June 2025; Medtronic recommends patients keep their monitor plugged in so it can receive the update, maintain physical possession of the device, and obtain replacement monitors only from an authorized healthcare provider or Medtronic representative (CISA ICS Medical Advisory ICSMA-25-205-01; Medtronic MyCareLink Patient Monitor security bulletin).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00305 (23.5th percentile) as of 2026-11-07 — a medium-severity flaw that, like its companion CVE-2025-4393/4394/4386/4397, requires an attacker to physically possess the patient's monitor before it can be exploited (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, patients and clinics using a MyCareLink Patient Monitor model 24950 or 24952 should confirm the device has received Medtronic's June 2025 update, keep the monitor plugged in and under the patient's physical control, and source any replacement unit only through Medtronic or an authorized provider.

• Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, allowing an attacker with physical access to log in with no password and modify system functionality; affects models 24950 and 24952 before June 25, 2025. — NVD
• NVD status is 'Deferred' with only a Medtronic-submitted Secondary score of CVSS v3.1 6.8, vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD-published Primary score. — NVD
• CISA bundles CVE-2025-4395 with CVE-2025-4393, CVE-2025-4394, CVE-2025-4386 and CVE-2025-4397; successful exploitation of the set could lead to system compromise, unauthorized data access, and manipulation of monitor functionality, all requiring physical tampering; affects Healthcare and Public Health sector worldwide, Ireland-headquartered vendor; reported by Ethan Morchy of Somerset Recon, Carl Mann, and an independent researcher. — CISA ICS Medical Advisory ICSMA-25-205-01
• Medtronic began deploying an automatic security update to in-use MyCareLink Patient Monitors in June 2025. — Medtronic MyCareLink Patient Monitor security bulletin
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00305 (23.5th percentile) as of 2026-11-07. — FIRST EPSS