CVE-2020-25187

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

3.77%

Published

Dec 14, 2020

Modified

May 22, 2025

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event within the MCL Smart Patient Reader software stack. The heap overflow could allow an attacker to remotely execute code on the MCL Smart Patient Reader, potentially leading to control of the device

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-122CWE-787

Affected Products (2)

medtronic · mycarelink_smart_model_25000_firmwarevulnerable

medtronic · mycarelink_smart_model_25000

References (3)

https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-smart-security-vulnerability-patch.html

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-345-01

https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01

Third Party AdvisoryUS Government Resource

KEV Catalog EPSS Scores Vendors All CVEs