Vulnerability

Qardio Heart Health apps expose credentials that reach an engineering backdoor

MedDevice Cyber Staff · Feb 13 · 3 min read · Via CISA ICSMA-25-044-01

CISA published advisory ICSMA-25-044-01 on February 13, 2025, covering three vulnerabilities in the Qardio Heart Health iOS app 2.7.4, the Android app 2.5.1 and all versions of the QardioARM A100. Bryan Riggins of Insulet Corporation reported them.

CVE-2025-20615 (CWE-359, CVSS 6.2) is the most striking. The iOS app exposes usernames and passwords in a plist file. With them an attacker can log in to production-level development accounts and reach an engineering backdoor in the app that sends hex-based commands over a UI-based terminal.

CVE-2025-24836 (CWE-248, CVSS 7.1) is the highest score. A Python script can send continuous startMeasurement commands to the device over an unencrypted Bluetooth connection, flooding it so it cannot connect to a clinician's app to take readings. CVE-2025-23421 (CWE-552, CVSS 6.4) lets an attacker obtain firmware files and reverse engineer them.

Qardio did not respond to CISA's requests to coordinate, so the advisory lists no fix. Users are pointed to Qardio customer support.

The interim advice is what a user can do alone: disable Bluetooth when not in use, avoid using the device in public or within Bluetooth range of malicious actors, and only use trusted mobile apps.

Engineering commands that survive into a production build are a backdoor whatever the team called them during development.

Are you a representative of Qardio? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no vendor fix: Qardio did not respond to CISA. Users of the QardioARM A100 and the Qardio Heart Health apps should disable Bluetooth when not in use, avoid taking readings in public or near untrusted parties, and install apps only from trusted sources. Clinical programs relying on QardioARM readings should plan for the device being unavailable.

Turn Bluetooth off between readings. This closes the window for the startMeasurement flood and other radio attacks.
Avoid public use. Take readings away from crowds and outside Bluetooth range of people you do not trust.
Install apps from trusted sources only. Use the official app store listing and keep the app current.
Contact Qardio support. Ask for an update status, since the advisory lists no fix.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Mobile app Wireless connectivity

Contributing

Home use User accounts

Qardio Heart Health app

PID-3321 Mobile app User accounts

QardioARM A100

PID-4112 Wireless connectivity

Fix the class in your product

The firmware does something undocumented: beacons to a hard-coded address, answers a hidden command. As the maker, strip every debug and undocumented path from the release image, remove hard-coded destinations, and require a firmware bill of materials and provenance for every sourced component.

Strip debug paths. Compile diagnostic and undocumented handlers out of the release build and assert their absence.
Remove hard-coded destinations. Every network destination is configured and validated, never baked in.
Demand provenance. Require and verify a firmware bill of materials for sourced blobs.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2025-20615 in the Qardio Heart Health iOS app?

CVE-2025-20615 (CWE-359, CVSS v3 6.2) is an exposure of usernames and passwords in a plist file in the Qardio Heart Health iOS app 2.7.4. The credentials let an attacker log in to production-level development accounts and reach an engineering backdoor that sends hex-based commands. CISA published it in ICSMA-25-044-01 on February 13, 2025.

Is there a fix for the QardioARM A100 Bluetooth denial of service CVE-2025-24836?

No fix is listed. Qardio did not respond to CISA's requests to mitigate CVE-2025-24836 (CVSS 7.1), an unencrypted Bluetooth command flood against the QardioARM A100. CISA advisory ICSMA-25-044-01, from February 13, 2025, advises disabling Bluetooth when not in use.

How can an attacker get QardioARM firmware under CVE-2025-23421?

CVE-2025-23421 (CWE-552, CVSS 6.4) lets an attacker obtain firmware files for hardware enabled by the Qardio iOS and Android apps and reverse engineer them, per CISA advisory ICSMA-25-044-01, published February 13, 2025.

← Back to Vulnerabilities

Key Facts

Product 1: Qardio Heart Health app iOS 2.7.4; Android 2.5.1 (Qardio)
Device Type: Health monitoring mobile app
Product 2: QardioARM A100 All versions (Qardio)
Device Type: Bluetooth home measurement device
Components: Mobile Application, User Interface, Firmware
Interface: Bluetooth
Dataflows: Python script to QardioARM A100 over Bluetooth (startMeasurement commands); QardioARM A100 to clinician's app (readings); Qardio iOS app to device via engineering backdoor (hex-based commands over UI terminal)
Assets: Usernames and passwords for production-level development accounts stored in a plist file (Credentials); QardioARM A100 firmware files (Firmware); Device readings taken by the clinician's app (Sensor Data)
Advisory: ICSMA-25-044-01
CVEs: CVE-2025-20615, CVE-2025-24836
CVSS: 7.1
Severity: High
Disclosed: Feb 13, 2025
Source: CISA ICSMA-25-044-01

Sources

Qardio: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: Qardio