CVE-2025-23421
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Summary
An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enabled by the Qardio iOS and Android applications.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Qardio | Heart Health IOS Mobile Application | 2.7.4 | affected |
| Qardio | Heart Health Android Mobile Application | 2.5.1 | affected |
Weaknesses
- CWE-552: CWE-552 Files or Directories Accessible to External Parties
Workarounds
Qardio has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of these affected products are invited to contact Qardio customer support https://www.qardio.com/about-us/#contact for additional information. Users should do the following to help mitigate the risk:
Disable Bluetooth when not in use.
Don't use this device in public or within Bluetooth range of malicious actors.
Only use trusted mobile apps from trusted providers.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01
- https://www.qardio.com/about-us/#contact
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.