CVE-2025-24836 - CVE House
Back to Database
Status published Medium CVE-2025-24836

Qardio Heart Health IOS and Android Application and QardioARM A100 Uncaught Exception

Vulnerability Description

With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected device. This would prevent the device from connecting to a clinician's app to take patient readings and ostensibly flood it with requests, resulting in a denial-of-service condition.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24836

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA.

References

More from Qardio

View All →
CVE-2025-23421
Qardio iOS and Android applications Files or Directories Accessible to External Parties
Medium 6.9
CVE-2025-20615
Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor
Medium 6.2

Affected Vendor

Affected Software

Heart Health IOS Mobile Application, Heart Health Android Mobile Application, QardioARM
Vulnerable Versions:
2.7.4, 2.5.1, All versions

Timeline

Official Publish: February 13th, 2025
Last Modified: February 14th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

Weaknesses (CWE)

CWE-248

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection
T1499.003 Application Exhaustion Flood
Impact