EMS patient-care app reflects unsanitized input into a WebView

MedDevice Cyber Staff · Feb 10 · 2 min read · Via CISA

ZOLL got ICSMA-26-041-01 for its ePCR iOS app, version 2.6.7, the tool EMS crews use for electronic patient-care reporting. CVE-2025-12699, unsanitized user input reflected into a WebView, base score 5.5. Script injection through PCR fields, exposing PHI and device telemetry captured in the back of an ambulance and rendered in a mobile web view that trusts what was typed into it.

Reflected injection of this kind occurs when an application takes text a person entered and renders it back inside a component that interprets markup and script. A native app hosting a web view is running an embedded browser, and if the field contents reach that view without being neutralized, characters that should be plain data are read as instructions instead. The boundary between content and code is the thing that failed.

Embedded web views are common in clinical mobile software because they let a team reuse existing web forms and layouts inside a native shell rather than build every screen twice. That convenience carries the web's entire injection problem into the app, and input captured under field conditions, often quickly and without review, is exactly the untrusted data that exposes it.

Bryan Riggins reported it, and ZOLL runs a public advisory page that put the fix and the guidance in one place. A WebView is a browser. Anything you render in it is subject to the same injection rules as a website, and clinical form fields are user input like any other.

A patient-care report drafted in the back of an ambulance holds identifiers, clinical detail and device readings, and a crew working an emergency has neither the time nor the tooling to notice that a form entry carried a payload. Content that executes inside the reporting app can reach the protected information the app handles and the telemetry the device records, all from an entry that looked like an ordinary note.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The ZOLL ePCR iOS app reflected unsanitized field input into a WebView (ICSMA-26-041-01), opening script injection that could expose the PHI captured in the field. Update to the fixed app version and, if you build WebView-based apps, encode all user input before it renders.

Update the app. Move every device to the fixed ePCR version from ICSMA-26-041-01.
Encode input into WebViews. Treat all field-entered data as untrusted and context-encode it before it reaches a WebView, since that is the injection path.
Add a content security policy. Constrain what a WebView can execute so injected script has no room to run even if encoding is missed.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

data_phi

Contributing

app_mobile net_cloud net_remote_access app_user_accounts use_home

EMB3D

PID-311

Fix the class in your product

Field input is reflected into a WebView without encoding, so input becomes script in the app context. As the maker, context-encode every value before it renders, set a strict content security policy, and prefer native rendering for sensitive data.

Encode at every sink. Render user data with textContent or an auto-escaping template, never innerHTML.
Set a strict CSP. Block inline and injected script as a second layer.
Prefer native rendering. Keep PHI out of a WebView where a missed encode becomes code.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2025-12699 in the ZOLL ePCR app?

Unsanitized user input reflected into a WebView in version 2.6.7 of the iOS app, base score 5.5, covered by ICSMA-26-041-01. Script injection through patient care report fields could expose PHI and device telemetry.

Why treat a WebView like a website?

A WebView is a browser. Anything rendered in it follows the same injection rules as the open web, and clinical form fields are user input like any other. Bryan Riggins reported the flaw and ZOLL published fix guidance on its advisory page.

← Back to Vulnerabilities