CVE-2025-12997CWE-639

CVE-2025-12997

Low · published December 5, 2025

CVSS v3.1
2.2
EPSS
0%
Percentile
7.7
In the wild
Unconfirmed
What it is

Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network: before December 4, 2025.

The record
Technical detail
CVSS v3.1
2.2 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00185 · 7.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-12-05T01:16Z
Affected products (1)
ProductVersionsFixed in
medtronic/carelink_network< 2025-12-042025-12-04
References (1)
https://www.medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html · [email protected]
EPSS history
Timeline
  • 04 DEC 20:04Z
    Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user…
    cvelistv5