CVE-2025-12996

MEDIUM

Medtronic CareLink Network <December 4, 2025 - Info Disclosure

Title source: llm

Description

Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This issue affects CareLink Network: before December 4, 2025.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://www.medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html

Scores

CVSS v3 4.1

EPSS 0.0009

EPSS Percentile 0.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-532

Status published

Products (1)

medtronic/carelink_network < 2025-12-04

Published Dec 04, 2025

Tracked Since Feb 18, 2026