Medtronic in MedDevice Cyber coverage: 30 stories, 40 products named, 31 CVEs, and the company's own disclosures.
AdvaMed's board chair says the group will treat cybersecurity like a code of ethics after Stryker, Boston Scientific, Medtronic, Abbott and Intuitive all reported attacks this year.
MedTech Dive counted nine medtech companies disclosing cyber incidents in 2026, from UFP Technologies in February to Baylor Genetics in August. Stryker took a material first quarter hit and weeks of operational disruption, Medtronic notified 3,834,294 people, and social engineering opened Cook Medical, AdaptHealth, and Intuitive Surgical. Every intrusion started in corporate IT or at a third party.
Two months after an 8-K disclosed unauthorized access to corporate IT systems, Medtronic began notifying affected people. The company reports no product, patient safety or manufacturing impact and no sign of the data online.
Medtronic disclosed four flaws in the CareLink Network web layer, including observable-response user enumeration, after researchers probed a non-production instance at a security conference. Patched, no patient harm.
ICSMA-25-205-01: the Medtronic MyCareLink monitor stored data unencrypted, shipped a built-in account with an empty password, and deserialized untrusted data. Physical access required, no evidence of exploitation.
Medtronic said on January 30, 2025 that it disabled the servers behind the RemoteView feature of the CareLink 2090 Programmer after critical BeyondTrust flaw CVE-2024-12356; no customer action is needed.
Medtronic said on November 30, 2023 that NextGen Mirth Connect 4.4.0 and prior, used with Mainspring Data Express CareLink EHR Integration and in Vital Sync, is affected by CVE-2023-37679 and CVE-2023-43208.
CISA advisory ICSMA-23-180-01 covers CVE-2023-31222 (CVSS 9.8), deserialization of untrusted data in Medtronic Paceart Optima 1.11 and prior when the optional Paceart Messaging Service is enabled. Version 1.12 fixes it; disabling the service mitigates it.
CISA advisory ICSMA-23-061-01 reports an unverified password change (CVE-2023-25931, CVSS v3 6.4) in the Medtronic Micro Clinician (A51200) and InterStim X Clinician (A51300) apps that can reset a custom password to default. An app update available since February 23, 2023 fixes it.
Medtronic said on January 19, 2023 that superDimension navigation system V7 family and V61 and earlier run on Microsoft Windows platforms Microsoft no longer supports, which could allow unauthorized code execution.
Medtronic published a security bulletin on September 29, 2022 covering vulnerabilities in the ILLUMISITE fluoroscopic navigation platform.
CISA advisory ICSMA-22-263-01 covers CVE-2022-32537 (CVSS 4.8) in Medtronic MiniMed 620G, 630G, 640G and 670G insulin pumps: an attacker in wireless range during pairing could learn the protocol and later alter insulin delivery. Turning off remote bolus removes that path.
Medtronic published a security bulletin on June 9, 2022 covering a DDS vulnerability in the Valleylab FT10 energy platform.
Medtronic published a security bulletin on June 9, 2022 covering a DDS vulnerability in the Valleylab FX8 generator.
CISA advisory ICSMA-20-345-01 covers an authentication bypass (CVE-2020-25183, CVSS v3 8.0), a heap overflow (CVE-2020-25187, CVSS v3 8.8) and an update race allowing unsigned firmware (CVE-2020-27252, CVSS v3 8.8) in the Medtronic MyCareLink Smart Model 25000 Patient Reader. App version 5.2 delivers the fix.
Medtronic said on November 19, 2020 that the TiYunZong vulnerability on Samsung CT900 tablets affects the A610, A710, A71100 and A810 clinician programmer applications; exploitation requires visiting a malicious website in Chrome.
Medtronic said on September 10, 2020 that two Bluetooth Low Energy flaws between BlueSync Azure, Percepta, Serena and Solera devices and the CareLink SmartSync Device Manager 24970A could disrupt programming sessions and drain battery.
Medtronic said on June 11, 2020 that the BIAS Bluetooth impersonation vulnerability affects the FA Controller (model 3537) and Patient Telemetry Module (model 97745).
Medtronic said on March 4, 2020 that SweynTooth BLE vulnerabilities in pre-made hardware components affect Azure, Percepta, Serena, Solera, Cobalt and Crome devices plus Guardian Connect, Envision Pro and MiniMed Connect, with communication disruption only.
CISA advisory ICSMA-19-311-02 covers hard-coded credentials (CVE-2019-13543), weak descrypt password hashing (CVE-2019-13539) and a vulnerable rssh utility (CVE-2019-3464, CVE-2019-3463, CVSS 9.8) in Medtronic Valleylab FT10 and FX8 energy platforms. FT10 patches are out; FX8 patches follow in early 2020.
CISA advisory ICSMA-19-311-01 covers CVE-2019-13531 and CVE-2019-13535 in the Medtronic Valleylab FT10 and LS10 Energy Platforms, where the RFID instrument authentication can be read and bypassed with physical access. Medtronic released a software patch.
CISA advisory ICSMA-19-178-01 reports improper access control (CVE-2019-10964, CVSS v3 7.1) in the RF protocol of the Medtronic MiniMed 508 and later MiniMed 511 through Veo 754 insulin pumps. There is no fix; Medtronic recommends moving patients to a newer pump.
Medtronic published a security bulletin on March 21, 2019 covering its Conexus telemetry and monitoring accessories.
CISA advisory ICSMA-19-080-01 reports that the Medtronic Conexus RF telemetry protocol implements no authentication (CVE-2019-6538, CVSS v3 9.3) and no encryption (CVE-2019-6540, CVSS v3 6.5) across Medtronic ICDs, CRT-Ds, CareLink programmers and home monitors. Patches cover a subset of implant models.
CISA advisory ICSMA-18-347-01 reports that all versions of the Medtronic CareLink 9790, CareLink 2090 and 29901 Encore programmers do not encrypt PII and PHI at rest (CVE-2018-18984, CVSS v3 4.6). The 9790 is end of life; Medtronic recommends data deletion and controlled disposal.
CISA advisory ICSMA-18-219-02 covers cleartext radio traffic (CVE-2018-10634) and a capture-replay flaw (CVE-2018-14781) in Medtronic MMT-500 and MMT-503 remote controllers paired with MiniMed insulin pumps. Medtronic told users to stop using and return the remotes.
CISA advisory ICSMA-18-219-01 reports recoverable per-product credentials (CVE-2018-10622, CVSS v3 6.8) and weak upload verification (CVE-2018-10626, CVSS v3 4.4) in all versions of the Medtronic MyCareLink 24950 and 24952 patient monitors. Medtronic fixed the upload check server-side; no monitor firmware change is listed.
CISA advisory ICSMA-18-179-01 covers a hard-coded operating system password (CVE-2018-8870) and exposed debug code (CVE-2018-8868) in Medtronic MyCareLink 24950 and 24952 monitors, all versions. Medtronic is fixing them with automatic over-the-air updates.
CISA advisory ICSMA-18-137-01 covers unencrypted PHI at rest (CVE-2018-8849) and a protection mechanism failure that runs modified card binaries (CVE-2018-10631) in the Medtronic 8840 N'Vision Clinician Programmer and 8870 Application Card. Medtronic has no product update.
CISA advisory ICSMA-18-058-01 covers three flaws in all versions of the Medtronic 2090 CareLink and 29901 Encore programmers, including updates fetched over HTTP without origin or integrity checks (CVE-2018-10596, CVSS v3 7.1). Medtronic disabled network updates, then shipped mitigating patches.
Medtronic products with the device attributes their own public documentation states, and the advisories in our coverage that share those attributes.
| Product | Device type | Attributes | Matched advisories |
|---|---|---|---|
| InPen System App (MMT-8060 (iOS), MMT-8061 | Calculator, Drug Dose | 27 | 22 |
| Endoflip 300 | System, Gastrointestinal Motility (Electrical) | 35 | 16 |
| Medtronic Commander Flex | System, Measurement, Blood-Pressure, Non-Invasive | 18 | 15 |
| LINQ II Insertable Cardiac Monitor, Zelda AI ECG Classification System | Recorder, Event, Implantable Cardiac, (With Arrhythmia Detection) | 22 | 12 |
| LINQ II Insertable Cardiac Monitor | Recorder, Event, Implantable Cardiac, (With Arrhythmia Detection) | 26 | 7 |
| Endoflip 300 System | System, Gastrointestinal Motility (Electrical) | 22 | 2 |
| Signia Circular Adapter (Standard Length) (SIGCIRSTND) | Stapler, Surgical | 9 | 2 |
| Becker External Drainage and Monitoring System | Device, Monitoring, Intracranial Pressure | 2 | 0 |
| Cardioblate Gemini-s 49260 Surgical Ablation Device | Surgical Device, For Cutting, Coagulation, And/Or Ablation Of Tissue, Including Cardiac Tissue | 4 | 0 |
| Cardioblate Gemini-s Surgical Ablation Device | Surgical Device, For Cutting, Coagulation, And/Or Ablation Of Tissue, Including Cardiac Tissue | 4 | 0 |
| Emprint Ablation System with Thermosphere Technology | System, Ablation, Microwave And Accessories | 8 | 0 |
| Emprint SX Ablation Platform with Thermosphere Technology | System, Ablation, Microwave And Accessories | 11 | 0 |
| Instrument Exit Point on Touch Surgery Aide | Endoscopic Video Imaging System / Software Component For Real Time Video Augmentation | 5 | 0 |
| LigaSure RAS Maryland Jaw Vessel Sealer/Divider, Nano-coated | Electrosurgical, Cutting & Coagulation & Accessories | 2 | 0 |
| LINQTM II Insertable Cardiac Monitor | 15 | 0 | |
| Medtronic Model 5392 External Pulse Generator | Pulse-Generator, Pacemaker, External | 8 | 0 |
| MYOtherm XP Cardioplegia Delivery System with Cortiva BioActive | Heat-Exchanger, Cardiopulmonary Bypass | 2 | 0 |
| NIM Vital, Nerve Integrity Monitor | Stimulator, Electrical, Evoked Response | 19 | 0 |
| O-arm O2 Imaging System | Interventional Fluoroscopic X-Ray System | 5 | 0 |
| O-arm O2 Imaging System | Interventional Fluoroscopic X-Ray System | 9 | 0 |
| OsteoCool 2.0 RF Ablation System | Electrosurgical, Cutting & Coagulation & Accessories | 3 | 0 |
| OsteoCool RF Ablation System; OsteoCool 2.0 RF Ablation System | Electrosurgical, Cutting & Coagulation & Accessories | 3 | 0 |
| PlasmaBlade X 3.0S LIGHT | Electrosurgical, Cutting & Coagulation & Accessories | 1 | 0 |
| Puritan Bennett 980 Series Ventilator System | Ventilator, Continuous, Facility Use | 8 | 0 |
| Puritan Bennett Cuff Pressure Manager | Cuff, Tracheal Tube, Inflatable | 8 | 0 |
| Reveal LINQ Insertable Cardiac Monitor | Recorder, Event, Implantable Cardiac, (With Arrhythmia Detection) | 21 | 0 |
| Reveal LINQTM Insertable Cardiac Monitor | 14 | 0 | |
| Signia Stapler | Staple, Implantable | 8 | 0 |
| Stealth AXiS Cranial clinical application | Neurological Stereotaxic Instrument | 10 | 0 |
| Stealth AXiS ENT clinical application | Ear, Nose, And Throat Stereotaxic Instrument | 4 | 0 |
| Stealth AXiS Surgical System with Stealth AXiS Spine clinical | Orthopedic Stereotaxic Instrument | 8 | 0 |
| StealthStation Cranial Software v1.3.0 | Neurological Stereotaxic Instrument | 10 | 0 |
| StealthStation Cranial Software v1.3.2 | Neurological Stereotaxic Instrument | 12 | 0 |
| StealthStation Cranial Software, v3.1.5 | Neurological Stereotaxic Instrument | 11 | 0 |
| StealthStation FlexENT (9736242) | Ear, Nose, And Throat Stereotaxic Instrument | 11 | 0 |
| StealthStation S8 Cranial v2.0 | Neurological Stereotaxic Instrument | 12 | 0 |
| StealthStation S8 Spine Software | Orthopedic Stereotaxic Instrument | 8 | 0 |
| Stealthstation S8 Spine Software v1.3.0 | Orthopedic Stereotaxic Instrument | 5 | 0 |
| StrataMR II Valves and Shunts | Shunt, Central Nervous System And Components | 5 | 0 |
| Streamline Unipolar Pediatric Temporary Pacing Lead (6491) Streamline | Electrode, Pacemaker, Temporary | 1 | 0 |
| Synergy Cranial v2.2.9, StealthStation Cranial v3.1.4 | Neurological Stereotaxic Instrument | 7 | 0 |
| Tri-Staple 2.0 Black Circular Reload 21mm Extra Thick (SIGCIR21XT) | Stapler, Surgical | 4 | 0 |
| TYRX Neuro Absorbable Antibacterial Envelope (Medium) | Mesh, Surgical, Polymeric | 1 | 0 |
| Valleylab FT10 Energy Platform Software Version 5.0 | Electrosurgical, Cutting & Coagulation & Accessories | 5 | 0 |
| VitalFlow Console | Blood Pump For Ecmo, Long-Term (> 6 Hours) Use | 11 | 0 |
| VitalFlow Set with Balance Biosurface | Extracorporeal System For Long-Term Respiratory / Cardiopulmonary Failure | 3 | 0 |