CVE-2025-20615 - CVE House
Back to Database
Status published Medium CVE-2025-20615

Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor

Vulnerability Description

The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-20615

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA.

References

More from Qardio

View All →
CVE-2025-24836
Qardio Heart Health IOS and Android Application and QardioARM A100 Uncaught Exception
Medium 6.1
CVE-2025-23421
Qardio iOS and Android applications Files or Directories Accessible to External Parties
Medium 6.9

Affected Vendor

Affected Software

Heart Health IOS Mobile Application
Vulnerable Versions:
2.7.4

Timeline

Official Publish: February 13th, 2025
Last Modified: February 14th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-359

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.