Insecure Direct Object Reference in Medtronic CareLink Network
CVE-2025-12997

2.2LOW

Key Information:

Vendor

Medtronic

Status
Carelink Network
Vendor
CVE Published:
4 December 2025

What is CVE-2025-12997?

An Insecure Direct Object Reference vulnerability exists in the Medtronic CareLink Network, which could allow an authenticated attacker to exploit specific device and user data. By submitting crafted web requests to an unsecured API endpoint, an attacker may gain unauthorized access to sensitive user information. This vulnerability potentially compromises user privacy and data integrity, emphasizing the need for enhanced security measures before the specified deadline.

Affected Version(s)

CareLink Network 0

References

https://www.medtronic.com/en-us/e/product-security/securi...
vendor-advisory

CVSS V3.1

Score:
2.2
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ionut Cernica
JSON
.
CVE-2025-12997 : Insecure Direct Object Reference in Medtronic CareLink Network