Description (CNA)
The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Qardio / Heart Health IOS Mobile Application | affected 2.7.4 |
CWE
CWE-359
References
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01
- https://www.qardio.com/about-us/#contact
ADP enrichment
No English description supplied.
No references supplied.