Vulnerability

Dario Health glucose monitoring app and servers exposed cross-user health data

MedDevice Cyber Staff · Feb 27 · 3 min read · Via CISA ICSMA-25-058-01

CISA published advisory ICSMA-25-058-01 on February 27, 2025, covering seven vulnerabilities in the Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android application, versions 5.8.7.0.36 and prior, and in Dario's application database and internet-based server infrastructure. Noah Cutler and Manuel Del Rio of Accenture reported them.

CVE-2025-20060 (CWE-359, CVSS v3 7.5) is the headline. An attacker could expose other users' PII and personal health information transmitted to the Android device through the Dario Health application database. CVE-2025-24849 (CWE-319, CVSS 7.1) is missing encryption in transit for the cloud infrastructure.

The portal side adds cross-site scripting (CVE-2025-20049, CVSS 5.8) and a session cookie without the HttpOnly flag (CVE-2025-24318, CVSS 6.8), which together could mean full session compromise. The list closes with unauthenticated log injection (CVE-2025-23405), an insecure file retrieval process (CVE-2025-24843) and exposed development environment details (CVE-2025-24316).

Dario recommends updating the Android app to the latest version, with no other action required from users. Its added guidance: install from trusted sources, avoid rooted or jailbroken devices and avoid public untrusted networks.

Server-side fixes carry most of the weight here. The app update cannot fix the cloud's transport encryption or its access checks on someone else's records.

Are you a representative of Dario Health? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the Dario Health Android app past 5.8.7.0.36 to the latest version. Use it only on non-rooted phones and avoid public untrusted networks. Programs that deploy Dario to patients should ask Dario to confirm the server-side fixes for transport encryption, XSS and cross-user access.

Update the app. Install the latest Dario Health Android release from a trusted store.
Avoid rooted phones and public Wi-Fi. Both widen exposure while server fixes roll out.
Confirm server remediation. Ask Dario Health to confirm the cloud fixes for CVE-2025-24849, CVE-2025-20049 and CVE-2025-20060.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Cloud connectivity Mobile app Handles patient data

Contributing

Web interface Home use USB port

USB-C Blood Glucose Monitoring System Starter Kit Android Application

Mobile app Handles patient data

Dario Application Database and Internet-based Server Infrastructure

PID-4112 PID-311 Cloud connectivity Web interface Patient or study database

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novum IQ Large Volume Pump	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Aperio GT 450 DX; Aperio GT 180 DX	Leica Biosystems	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aetherSlide	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Management V15	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer

32 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2025-20060 in the Dario Health glucose monitoring app?

CVE-2025-20060 (CWE-359, CVSS v3 7.5) lets an attacker expose other users' PII and personal health information sent to the Dario Health USB-C Blood Glucose Monitoring System Android app 5.8.7.0.36 and prior through the application database. CISA published it in ICSMA-25-058-01 on February 27, 2025.

What should Dario Health app users do about ICSMA-25-058-01?

Dario Health recommends updating the Android app to the latest version, installing only from trusted sources, avoiding rooted or jailbroken devices and avoiding public untrusted networks, according to CISA advisory ICSMA-25-058-01 from February 27, 2025.

← Back to Vulnerabilities