Cyber Resilience

CVE-2025-4386

Published
07 May 2026
Modified
17 June 2026
CVSS Score v3.1 6.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 5th percentile
Risk Priority 48 floored blend · peak EPSS

Summary

CVE-2025-4386 is a medium-severity Improper Physical Access Control (CWE-1263) vulnerability in Cisa (inferred from references). Its CVSS base score is 6.8 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Replication Through Removable Media (T1091); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to PE-2 (Physical Access Authorizations) and PE-3 (Physical Access Control) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to access a login prompt via a UART terminal.​

CWE(s)
CWE-1263

Related Threats

MITRE ATT&CK Enterprise Techniques

T1091 Replication Through Removable Media Lateral Movement
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.
attack.mitre.org →
T1200 Hardware Additions Initial Access
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access.
attack.mitre.org →
T1052 Exfiltration Over Physical Medium Exfiltration
Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.
attack.mitre.org →
T1052.001 Exfiltration over USB Exfiltration
Adversaries may attempt to exfiltrate data over a USB connected physical device.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-38290Shared CWE-1263
CVE-2024-39512Shared CWE-1263
CVE-2024-28326Shared CWE-1263
CVE-2024-48973Shared CWE-1263
CVE-2025-59696Shared CWE-1263
CVE-2025-6785Shared CWE-1263
CVE-2025-8762Shared CWE-1263
CVE-2024-36438Shared CWE-1263

Affected Assets

Cisa
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

PE-3 Physical Access Control good match

Directly enforces physical access authorizations at entry points to restricted areas.

PE-2 Physical Access Authorizations good match

Maintains the authorized physical access list that the system must enforce.

PE-6 Monitoring Physical Access good match

Monitors physical access to detect unauthorized entry after the fact.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-06 full match
prevents

Directly requires managing, monitoring, and enforcing physical access to assets commensurate with risk.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.7.2 Physical entry full match
prevents

Specifies physical entry controls that prevent unauthorized actors from reaching protected information or assets.

A.7.1 Physical security perimeters mostly match
prevents

Defines physical perimeters that directly limit unauthorized physical access to restricted areas.

A.7.14 Secure disposal or re-use of equipment mostly match
prevents

Secure disposal prevents data exposure after equipment leaves controlled areas.

A.7.3 Securing offices, rooms and facilities mostly match
prevents

Requires securing offices, rooms and facilities to restrict physical access to areas containing sensitive information.

A.7.4 Physical security monitoring mostly match
finds

Monitoring supports detection but does not itself prevent unauthorized physical access.

A.7.8 Equipment siting and protection mostly match
prevents

Equipment siting helps reduce exposure but is secondary to access-control measures.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (2 rules)
  • V-248537 OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance. prevents CWE-1263
  • V-248540 OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263
RHEL 7 (2 rules)
  • V-204440 Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263
  • V-204438 Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263

References