Vulnerability

Medtronic disables RemoteView servers for CareLink 2090 programmer after BeyondTrust CVE-2024-12356

MedDevice Cyber Staff · Jan 30 · 2 min read · Via Medtronic security disclosure

Medtronic published a bulletin on January 30, 2025 on CVE-2024-12356, a critical flaw in BeyondTrust Privileged Remote Access and Remote Support that could allow an unauthenticated attacker to inject commands that run as a site user. The affected Medtronic features are RemoteView for the CareLink 2090 Programmer and its RemoteControl extension.

Medtronic disabled the supporting servers and observed no exploitation. The company states no customer action is needed.

Remote support tooling is third-party software with a direct line into clinical equipment. When the vendor owns the server, pulling it offline is the fastest mitigation available, and hospitals should expect the remote session feature to be unavailable while it is down.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Medtronic disabled the RemoteView servers for the CareLink 2090 Programmer and states no customer action is needed for CVE-2024-12356. Hospitals should confirm no local BeyondTrust instance of their own is exposed and plan for RemoteView sessions being unavailable.

Note the feature outage. Tell clinical staff that RemoteView and RemoteControl sessions for the CareLink 2090 Programmer are unavailable while servers are disabled.
Check your own BeyondTrust. Patch any hospital-run BeyondTrust Privileged Remote Access or Remote Support instance for CVE-2024-12356.
Inventory remote support paths. List every vendor remote access tool that reaches clinical devices and who operates its server.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Remote access

Contributing

Off-the-shelf software

CareLink 2090 Programmer RemoteView

Remote access Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Is the Medtronic CareLink 2090 programmer affected by BeyondTrust CVE-2024-12356?

Medtronic said on January 30, 2025 that the RemoteView feature and RemoteControl extension for the CareLink 2090 Programmer relied on BeyondTrust; it disabled the supporting servers, saw no exploitation and said no customer action is needed.

What is CVE-2024-12356?

CVE-2024-12356 is a critical flaw in BeyondTrust Privileged Remote Access and Remote Support that could let an unauthenticated attacker inject commands that run as a site user, per Medtronic's January 30, 2025 bulletin.

← Back to Vulnerabilities