CVE-2025-20615 (GCVE-0-2025-20615)

Vulnerability from cvelistv5 – Published: 2025-02-13 21:47 – Updated: 2025-02-14 15:46
VLAI?
Title
Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor
Summary
The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.
Severity ?
6.2 (Medium)
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CWE
Assigner
References
Impacted products
Vendor Product Version
Qardio Heart Health IOS Mobile Application Affected: 2.7.4
Create a notification for this product.
Credits
Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-14T15:36:26.768218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-14T15:46:53.224Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Heart Health IOS Mobile Application",
          "vendor": "Qardio",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Qardio Arm iOS application exposes sensitive data such as usernames \nand passwords in a plist file. This allows an attacker to log in to \nproduction-level development accounts and access an engineering backdoor\n in the application. The engineering backdoor allows the attacker to \nsend hex-based commands over a UI-based terminal."
            }
          ],
          "value": "The Qardio Arm iOS application exposes sensitive data such as usernames \nand passwords in a plist file. This allows an attacker to log in to \nproduction-level development accounts and access an engineering backdoor\n in the application. The engineering backdoor allows the attacker to \nsend hex-based commands over a UI-based terminal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-359",
              "description": "CWE-359",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-13T21:47:12.913Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01"
        },
        {
          "url": "https://www.qardio.com/about-us/#contact"
        }
      ],
      "source": {
        "advisory": "ICSMA-25-044-01",
        "discovery": "EXTERNAL"
      },
      "title": "Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Qardio has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of these affected products are invited to \ncontact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.qardio.com/about-us/#contact\"\u003eQardio customer support\u003c/a\u003e for additional information.\n\u003cp\u003eUsers should do the following to help mitigate the risk:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDisable Bluetooth when not in use.\u003c/li\u003e\n\u003cli\u003eDon\u0027t use this device in public or within Bluetooth range of malicious actors.\u003c/li\u003e\n\u003cli\u003eOnly use trusted mobile apps from trusted providers.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Qardio has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of these affected products are invited to \ncontact  Qardio customer support https://www.qardio.com/about-us/#contact  for additional information.\nUsers should do the following to help mitigate the risk:\n\n\n\n  *  Disable Bluetooth when not in use.\n\n  *  Don\u0027t use this device in public or within Bluetooth range of malicious actors.\n\n  *  Only use trusted mobile apps from trusted providers."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2025-20615",
    "datePublished": "2025-02-13T21:47:12.913Z",
    "dateReserved": "2025-02-10T15:16:25.268Z",
    "dateUpdated": "2025-02-14T15:46:53.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-20615\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2025-02-13T22:15:11.590\",\"lastModified\":\"2025-03-24T13:39:29.907\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Qardio Arm iOS application exposes sensitive data such as usernames \\nand passwords in a plist file. This allows an attacker to log in to \\nproduction-level development accounts and access an engineering backdoor\\n in the application. The engineering backdoor allows the attacker to \\nsend hex-based commands over a UI-based terminal.\"},{\"lang\":\"es\",\"value\":\"La aplicaci\u00f3n Qardio Arm para iOS expone datos confidenciales, como nombres de usuario y contrase\u00f1as, en un archivo plist. Esto permite que un atacante inicie sesi\u00f3n en cuentas de desarrollo de nivel de producci\u00f3n y acceda a una puerta trasera de ingenier\u00eda en la aplicaci\u00f3n. La puerta trasera de ingenier\u00eda permite al atacante enviar comandos basados en hexadecimales a trav\u00e9s de una terminal basada en UI.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":0.7,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.7,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-359\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qardio:qardio:2.7.4:*:*:*:*:iphone_os:*:*\",\"matchCriteriaId\":\"E68698AD-E33B-4C00-A016-FBF85EDAB538\"}]}]}],\"references\":[{\"url\":\"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"US Government Resource\"]},{\"url\":\"https://www.qardio.com/about-us/#contact\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Product\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor\", \"source\": {\"advisory\": \"ICSMA-25-044-01\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Qardio\", \"product\": \"Heart Health IOS Mobile Application\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.7.4\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01\"}, {\"url\": \"https://www.qardio.com/about-us/#contact\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Qardio has not responded to requests to work with CISA to mitigate these\\n vulnerabilities. Users of these affected products are invited to \\ncontact  Qardio customer support https://www.qardio.com/about-us/#contact  for additional information.\\nUsers should do the following to help mitigate the risk:\\n\\n\\n\\n  *  Disable Bluetooth when not in use.\\n\\n  *  Don\u0027t use this device in public or within Bluetooth range of malicious actors.\\n\\n  *  Only use trusted mobile apps from trusted providers.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Qardio has not responded to requests to work with CISA to mitigate these\\n vulnerabilities. Users of these affected products are invited to \\ncontact \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.qardio.com/about-us/#contact\\\"\u003eQardio customer support\u003c/a\u003e for additional information.\\n\u003cp\u003eUsers should do the following to help mitigate the risk:\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli\u003eDisable Bluetooth when not in use.\u003c/li\u003e\\n\u003cli\u003eDon\u0027t use this device in public or within Bluetooth range of malicious actors.\u003c/li\u003e\\n\u003cli\u003eOnly use trusted mobile apps from trusted providers.\u003c/li\u003e\\n\u003c/ul\u003e\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Qardio Arm iOS application exposes sensitive data such as usernames \\nand passwords in a plist file. This allows an attacker to log in to \\nproduction-level development accounts and access an engineering backdoor\\n in the application. The engineering backdoor allows the attacker to \\nsend hex-based commands over a UI-based terminal.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The Qardio Arm iOS application exposes sensitive data such as usernames \\nand passwords in a plist file. This allows an attacker to log in to \\nproduction-level development accounts and access an engineering backdoor\\n in the application. The engineering backdoor allows the attacker to \\nsend hex-based commands over a UI-based terminal.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-359\", \"description\": \"CWE-359\"}]}], \"providerMetadata\": {\"orgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"shortName\": \"icscert\", \"dateUpdated\": \"2025-02-13T21:47:12.913Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20615\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-14T15:36:26.768218Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2025-02-14T15:36:28.285Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-20615\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-13T21:47:12.913Z\", \"dateReserved\": \"2025-02-10T15:16:25.268Z\", \"assignerOrgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"datePublished\": \"2025-02-13T21:47:12.913Z\", \"assignerShortName\": \"icscert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.