CVE-2025-12997: Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated att

Q: How do I fix CVE-2025-12997?

carelink network: upgrade to 2025-12-04. Exact commands for each OS are on this page.

Q: Is CVE-2025-12997 being exploited?

CVE-2025-12997 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2025-12997 affect?

CVE-2025-12997 affects carelink network. Severity is low (CVSS 2.2). Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive us

Q: How urgent is CVE-2025-12997?

Priority 10/100. No elevated risk signals yet.

Routine

LOW 2.2UPGRADE

CVE-2025-12997 is a low-severity flaw (CVSS 2.2) affecting carelink network. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network: before December 4, 2025.

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	2.2 (Low)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	High
User interaction	None
EPSS exploit chance	0.2% (top 92%)
CISA exploited list	No
Weakness	CWE-639
Published	2025-12-04
Last modified	2026-09-25

Publisher (CNA): Medtronic · Vendor: medtronic

Last updated 2026-09-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-12-04 20:16 UTCPublished CVE record published
2026-09-25 23:10 UTCUpdated Record last modified

medtronic carelink network UPGRADE

Affected: < 2025-12-04

Fixed in: 2025-12-04

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy carelink-network || rpm -q carelink-network || carelink-network --version

2. UPGRADE to 2025-12-04 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade carelink-network

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade carelink-network

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-12997?

carelink network: upgrade to 2025-12-04. Exact commands for each OS are on this page.

Is CVE-2025-12997 being exploited?

CVE-2025-12997 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-12997 affect?

CVE-2025-12997 affects carelink network. Severity is low (CVSS 2.2). Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive us

How urgent is CVE-2025-12997?

Priority 10/100. No elevated risk signals yet.

Related CVEs

CVE-2025-12995 HIGH 8.1 UPGRADE Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API
CVE-2025-12994 MEDIUM 5.3 UPGRADE Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questi
CVE-2025-12996 MEDIUM 4.1 UPGRADE Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view

References

← Back to latest CVEs