LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

EMS patient-care app reflects unsanitized input into a WebView

MedDevice Cyber Staff · Feb 10 · 2 min read · Via CISA

ZOLL got ICSMA-26-041-01 for its ePCR iOS app, version 2.6.7, the tool EMS crews use for electronic patient-care reporting. CVE-2025-12699, unsanitized user input reflected into a WebView, base score 5.5. Script injection through PCR fields, exposing PHI and device telemetry captured in the back of an ambulance and rendered in a mobile web view that trusts what was typed into it.

Bryan Riggins reported it, and ZOLL runs a public advisory page that put the fix and the guidance in one place. A WebView is a browser. Anything you render in it is subject to the same injection rules as a website, and clinical form fields are user input like any other.

Remediation Desk

The ZOLL ePCR iOS app reflected unsanitized field input into a WebView (ICSMA-26-041-01), opening script injection that could expose the PHI captured in the field. Update to the fixed app version and, if you build WebView-based apps, encode all user input before it renders.

Update the app. Move every device to the fixed ePCR version from ICSMA-26-041-01.
Encode input into WebViews. Treat all field-entered data as untrusted and context-encode it before it reaches a WebView, since that is the injection path.
Add a content security policy. Constrain what a WebView can execute so injected script has no room to run even if encoding is missed.

Sources

CISA ↗

Questions & Answers

What is CVE-2025-12699 in the ZOLL ePCR app?

Unsanitized user input reflected into a WebView in version 2.6.7 of the iOS app, base score 5.5, covered by ICSMA-26-041-01. Script injection through patient care report fields could expose PHI and device telemetry.

Why treat a WebView like a website?

A WebView is a browser. Anything rendered in it follows the same injection rules as the open web, and clinical form fields are user input like any other. Bryan Riggins reported the flaw and ZOLL published fix guidance on its advisory page.

← Back to Vulnerabilities