CVE-2018-10626: Medtronic Mycarelink 24950 Patient Monitor Firmware

Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days.

Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLink network.

Affected products

• Medtronic Mycarelink 24950 Patient Monitor Firmware: affected versions not specified
• Medtronic Mycarelink 24952 Patient Monitor Firmware: affected versions not specified

Published 2018-08-10. Last modified 2026-06-17.