Skip to content
OpenAdvisories
High ICSMA-25-044-01 3 CVEs

Qardio Heart Health IOS and Android Application and QardioARM A100

Published Feb 13, 2025 · Updated Feb 13, 2025

Vendor: Qardio Product: Heart Health Android Mobile Application Product: Heart Health IOS Mobile Application Product: QardioARM A100

Summary

Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information, cause a denial-of-service condition, and obtain firmware files.

Vulnerabilities 3

  • High 7.1
    CVE-2025-24836

    Qardio Heart Health IOS and Android Application and QardioARM A100 Uncaught Exception

    With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected device. This would prevent the device from connecting to a clinician's app to take patient readings an…

    Qardio Heart Health IOS Mobile Application Heart Health Android Mobile Application QardioARM Android iOS
  • Medium 6.4
    CVE-2025-23421

    Qardio iOS and Android applications Files or Directories Accessible to External Parties

    An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enabled by the Qardio iOS and Android applications.

    Qardio Heart Health IOS Mobile Application Heart Health Android Mobile Application Android iOS
  • Medium 6.2
    CVE-2025-20615

    Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor

    The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor a…

    Qardio Heart Health IOS Mobile Application iOS

Revision history

  1. #1

    Initial Publication

References