Vulnerability · Published Feb 13, 2025 · Assigned by icscert
CVE-2025-20615Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor
Medium 6.2
In plain English
A medium-severity security flaw in Heart Health IOS Mobile Application from Qardio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)6.2Medium
Exploit odds (30 days)0.2%top 85.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Qardio | Heart Health IOS Mobile Application | 2.7.4 |
Weakness: CWE-359 · Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L