Medtronic MyCareLink Patient Monitor uses per‑product credentials stored in a recoverable format. An attacker who obtains these credentials can alter the device’s encrypted drive data, potentially causing inaccurate patient monitoring information and jeopardizing clinical decision‑making. The weakness is classified as CWE‑313, an insecure handling of sensitive credentials, leading to unauthorized modification of data.

The vulnerability affects Medtronic MyCareLink Patient Monitor models 24950 and 24952. No other model or version information is provided in the current advisory.

The CVSS score of 6.8 indicates a moderate severity, while EPSS data is unavailable and the vulnerability is not catalogued in CISA’s KEV list. The least‑privileged attacker would need valid credentials, which could be compromised through phishing, credential theft, or physical access. The likely attack vector is local or remote access to management interfaces that allow credential recovery. If the attacker succeeds, they can modify encrypted device storage, potentially leading to subtle data tampering that may go undetected.