CVE-2025-12997

LOW 3.1CVE-2025-12997 · Published 04/12/2025 · updated 25/09/2026

In short

CVE-2025-12997 is a LOW (CVSS 3.1) vulnerability affecting carelink network (medtronic).
Chance of exploitation in the next 30 days (EPSS): 0.18%, higher than 8.1% of all vulnerabilities.
Fix: update to 2025-12-04 or later.

Package	Affected versions	Patched versions
carelink network medtronic	`< 2025-12-04`	`2025-12-04`

Description

Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network: before December 4, 2025.

References

medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html · Vendor Advisory

More vulnerabilities in carelink network

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free