LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

User enumeration on the CareLink Network, found at a conference

MedDevice Cyber Staff · Dec 4 · 2 min read · Via Medtronic

Medtronic published a bulletin on four flaws in the non-medical web layer of the CareLink Network. CVE-2025-12994 and three others, the headline being observable-response user enumeration: the app answers differently for valid and invalid accounts, so an attacker can harvest a user list.

The disclosure path is the good part. Researchers examined a non-production instance at a security conference, findings surfaced and patched before they became an incident. No home monitors or apps were affected, patches auto-deployed in December, and Medtronic reported no patient harm.

Make authentication responses uniform, same message and same timing whether the account exists or not. User enumeration is low-severity alone, and it is the first step in the credential-stuffing and phishing that is not.

Remediation Desk

Medtronic patched four flaws in the CareLink Network web layer, including observable-response user enumeration found when researchers probed a non-production instance. The fix is deployed and no patient harm was reported; the operator lesson is to return uniform responses so a login or lookup cannot confirm which accounts exist.

Confirm the patched web layer. Medtronic remediated the CareLink Network findings server-side, so verify you are on the current service.
Return uniform responses. Authentication and lookup endpoints should answer identically whether or not an account exists, closing enumeration.
Rate-limit and monitor probing. Throttle repeated lookups and alert on enumeration patterns against public-facing endpoints.

Sources

Medtronic ↗

Questions & Answers

What did Medtronic disclose in the CareLink Network?

Four flaws in the CareLink Network web layer, including observable-response user enumeration tracked as CVE-2025-12994. The web app answered differently for valid and invalid users, which lets an attacker learn which accounts exist.

How serious is user enumeration on its own?

On its own it is medium. It does not grant access, but it hands an attacker a confirmed list of accounts to aim password attacks at, so it makes the next step easier.

Where was it found?

Researchers probed a non-production environment and reported it, and Medtronic addressed the web-layer issues. The fix removes the difference in responses that made enumeration possible.

← Back to Vulnerabilities