Medtronic MyCareLink Patient Monitor Physical Access Vulnerability

A vulnerability exists in the Medtronic MyCareLink Patient Monitor models 24950 and 24952, all versions, allowing an attacker with physical access to the device to access a login prompt through a UART terminal. This vulnerability arises from improper physical access control, enabling unauthorized interaction with the monitor's internal interface.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the device's functionality and sensitive data, potentially allowing for manipulation of the monitor's operations.

Remediation

Medtronic has begun deploying security updates to address these vulnerabilities. The update process is automatic when the monitor is connected to the internet. Patients should ensure their monitor is plugged in to receive updates.