Search criteria

2 vulnerabilities found for qardio by qardio

CVE-2025-20615 (GCVE-0-2025-20615)

Vulnerability from nvd – Published: 2025-02-13 21:47 – Updated: 2025-02-14 15:46
VLAI?
Title
Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor
Summary
The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.
Severity ?
6.2 (Medium)
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CWE
Assigner
References
Impacted products
Vendor Product Version
Qardio Heart Health IOS Mobile Application Affected: 2.7.4
Create a notification for this product.
Credits
Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-14T15:36:26.768218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-14T15:46:53.224Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Heart Health IOS Mobile Application",
          "vendor": "Qardio",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Qardio Arm iOS application exposes sensitive data such as usernames \nand passwords in a plist file. This allows an attacker to log in to \nproduction-level development accounts and access an engineering backdoor\n in the application. The engineering backdoor allows the attacker to \nsend hex-based commands over a UI-based terminal."
            }
          ],
          "value": "The Qardio Arm iOS application exposes sensitive data such as usernames \nand passwords in a plist file. This allows an attacker to log in to \nproduction-level development accounts and access an engineering backdoor\n in the application. The engineering backdoor allows the attacker to \nsend hex-based commands over a UI-based terminal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-359",
              "description": "CWE-359",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-13T21:47:12.913Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01"
        },
        {
          "url": "https://www.qardio.com/about-us/#contact"
        }
      ],
      "source": {
        "advisory": "ICSMA-25-044-01",
        "discovery": "EXTERNAL"
      },
      "title": "Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Qardio has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of these affected products are invited to \ncontact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.qardio.com/about-us/#contact\"\u003eQardio customer support\u003c/a\u003e for additional information.\n\u003cp\u003eUsers should do the following to help mitigate the risk:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDisable Bluetooth when not in use.\u003c/li\u003e\n\u003cli\u003eDon\u0027t use this device in public or within Bluetooth range of malicious actors.\u003c/li\u003e\n\u003cli\u003eOnly use trusted mobile apps from trusted providers.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Qardio has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of these affected products are invited to \ncontact  Qardio customer support https://www.qardio.com/about-us/#contact  for additional information.\nUsers should do the following to help mitigate the risk:\n\n\n\n  *  Disable Bluetooth when not in use.\n\n  *  Don\u0027t use this device in public or within Bluetooth range of malicious actors.\n\n  *  Only use trusted mobile apps from trusted providers."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2025-20615",
    "datePublished": "2025-02-13T21:47:12.913Z",
    "dateReserved": "2025-02-10T15:16:25.268Z",
    "dateUpdated": "2025-02-14T15:46:53.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-20615 (GCVE-0-2025-20615)

Vulnerability from cvelistv5 – Published: 2025-02-13 21:47 – Updated: 2025-02-14 15:46
VLAI?
Title
Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor
Summary
The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.
Severity ?
6.2 (Medium)
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CWE
Assigner
References
Impacted products
Vendor Product Version
Qardio Heart Health IOS Mobile Application Affected: 2.7.4
Create a notification for this product.
Credits
Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-14T15:36:26.768218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-14T15:46:53.224Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Heart Health IOS Mobile Application",
          "vendor": "Qardio",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Qardio Arm iOS application exposes sensitive data such as usernames \nand passwords in a plist file. This allows an attacker to log in to \nproduction-level development accounts and access an engineering backdoor\n in the application. The engineering backdoor allows the attacker to \nsend hex-based commands over a UI-based terminal."
            }
          ],
          "value": "The Qardio Arm iOS application exposes sensitive data such as usernames \nand passwords in a plist file. This allows an attacker to log in to \nproduction-level development accounts and access an engineering backdoor\n in the application. The engineering backdoor allows the attacker to \nsend hex-based commands over a UI-based terminal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-359",
              "description": "CWE-359",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-13T21:47:12.913Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01"
        },
        {
          "url": "https://www.qardio.com/about-us/#contact"
        }
      ],
      "source": {
        "advisory": "ICSMA-25-044-01",
        "discovery": "EXTERNAL"
      },
      "title": "Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Qardio has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of these affected products are invited to \ncontact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.qardio.com/about-us/#contact\"\u003eQardio customer support\u003c/a\u003e for additional information.\n\u003cp\u003eUsers should do the following to help mitigate the risk:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDisable Bluetooth when not in use.\u003c/li\u003e\n\u003cli\u003eDon\u0027t use this device in public or within Bluetooth range of malicious actors.\u003c/li\u003e\n\u003cli\u003eOnly use trusted mobile apps from trusted providers.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Qardio has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of these affected products are invited to \ncontact  Qardio customer support https://www.qardio.com/about-us/#contact  for additional information.\nUsers should do the following to help mitigate the risk:\n\n\n\n  *  Disable Bluetooth when not in use.\n\n  *  Don\u0027t use this device in public or within Bluetooth range of malicious actors.\n\n  *  Only use trusted mobile apps from trusted providers."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2025-20615",
    "datePublished": "2025-02-13T21:47:12.913Z",
    "dateReserved": "2025-02-10T15:16:25.268Z",
    "dateUpdated": "2025-02-14T15:46:53.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}