The Medtronic MyCareLink Patient Monitor drew ICSMA-25-205-01. Three findings: data on an unencrypted filesystem, a built-in account with an empty password, and an internal service that deserializes untrusted data. Top score around 6.8, all requiring physical access, and Medtronic reported no evidence of exploitation.
The physical-access requirement caps the severity. It does not excuse the findings. An empty-password account and cleartext storage are what a first-year secure-design review is supposed to catch. And home cardiac monitors sit on a nightstand for years, then get resold, returned and refurbished, so physical access is not exotic for a device that lives in a bedroom.
Medtronic auto-deployed updates. Credit to Ethan Morchy of Somerset Recon and Carl Mann. If you make home devices, assume the attacker will eventually hold the hardware and design the storage and accounts for that day.
Remediation Desk
The Medtronic MyCareLink monitor stored data unencrypted, shipped a built-in account with an empty password, and deserialized untrusted data (ICSMA-25-205-01), all requiring physical access with no exploitation reported. Apply the update, and if you build home monitors, encrypt data at rest, remove default accounts, and never deserialize untrusted input.
- Apply the vendor update. Install the remediated MyCareLink build from ICSMA-25-205-01.
- Remove empty and default accounts. No shipped device should carry a built-in account with an empty or known password.
- Encrypt data at rest. Protect stored patient data so physical access to the device does not hand over its contents.
- Stop deserializing untrusted data. Replace unsafe deserialization with a parser that validates structure and type before building objects.
Questions & Answers
What did ICSMA-25-205-01 find in the Medtronic MyCareLink monitor?
Three issues: data stored on an unencrypted filesystem, a built-in account with an empty password, and an internal service that deserializes untrusted data. Top score around 6.8, all requiring physical access, with no evidence of exploitation.
If physical access is required, why does it matter?
Home cardiac monitors sit on a nightstand for years and then get resold, returned or refurbished. For a device that lives in a bedroom, physical access is a normal part of the lifecycle, and storage and accounts should be designed for that day.
Was a fix deployed for the MyCareLink findings?
Yes. Medtronic auto-deployed updates to fielded monitors. Ethan Morchy of Somerset Recon and Carl Mann were credited with the findings.
