CVE-2025-4386 is a vulnerability in the Medtronic MyCareLink Patient Monitor 24950 where an internal serial interface exposes a login prompt accessible through a UART terminal. This improper physical access control (CWE-1263) allows an attacker with physical access to the device to potentially gain unauthorized access. The vulnerability has a CVSS 3.1 base score of 6.8, reflecting medium severity with high impact on confidentiality, integrity, and availability, but requires physical access to exploit.

If exploited, this vulnerability could allow an attacker with physical access to the device to bypass normal access controls via the UART interface, potentially compromising the confidentiality, integrity, and availability of the patient monitor. This could lead to unauthorized access to sensitive patient data or disruption of device functionality. However, exploitation requires physical access, limiting the attack surface.

No official patch or remediation has been announced by Medtronic for this vulnerability. Organizations using the affected device should monitor vendor communications for updates. Until a fix is available, restricting physical access to the device is the primary mitigation to prevent exploitation via the UART interface.