CVE-2020-25187

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Medtronic MyCareLink Smart 25000 is

vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event within the MCL Smart Patient Reader software stack. The heap overflow could allow an attacker to remotely execute code on the MCL Smart Patient Reader, potentially leading to control of the device

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Dec 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-251887.8An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the ap CVE-2020-251899.8The affected product is vulnerable to three stack-based buffer overflows, which may allow an unauthenticated attacker to remotely execute ar CVE-2020-25194.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected a CVE-2020-251909.8The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party servic CVE-2020-251917.5Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a functi CVE-2020-251925.3The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without prope CVE-2020-251935.3By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08 CVE-2020-251948.8The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an atta CVE-2020-251957.5The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when CVE-2020-251969.8The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to bru CVE-2020-251978.8A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to ver CVE-2020-251988.8The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixat