Technical impact
Medtronic MyCareLink Patient Monitor includes an internal serial interface that, when accessed through a UART terminal by anyone with physical proximity, presents a login prompt. This allows an attacker to bypass device authentication and potentially gain privileged control over the monitor’s functions, affecting patient data integrity and safety. The vulnerability is classified as a hardware debug access flaw (CWE-1263).
Affected Systems
The affected systems are Medtronic MyCareLink Patient Monitor models 24950 and 24952. No specific firmware or software version information is supplied.
Risk and Exploitability
The CVSS score of 6.8 indicates medium severity. EPSS data are not provided and the vulnerability is not listed in CISA KEV. The likely attack vector is physical access to the UART debug port; once accessed, the attacker can log in and potentially change settings or read sensitive data. While exploitation requires proximity, the impact on patient safety makes this a significant concern for installations that rely on these monitors.
