The Medtronic MyCareLink Patient Monitor 24950 stores per-product credentials in a recoverable cleartext format on disk, classified as CWE-313 (Cleartext Storage). An attacker with access to these credentials could use them to modify encrypted drive data, compromising confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 6.8, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official remediation level has been provided by Medtronic as of the published date.

The vulnerability allows an attacker to recover sensitive credentials stored in cleartext and use them to alter encrypted data on the device's drive. This can lead to unauthorized data modification and potential disruption of device functionality, impacting patient data confidentiality, integrity, and availability. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit physical and network access to the affected device to trusted personnel only. Monitor for any unusual activity related to device data integrity. Avoid storing sensitive credentials in recoverable formats and follow best practices once a patch is released.