PT-2020-14453 · Dr Trust · Dr Trust Ecg Pen

Arun Magesh · Published 2020-08-26 · Updated 2021-07-21 · CVE-2020-15486

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dr Trust ECG Pen version 2.00.08

Description An issue allows attackers to access the GATT server of the device without requiring pairing or security. This enables attackers to sniff data being broadcasted during measurements and extract saved data over a Bluetooth connection. Additionally, attackers can launch a man-in-the-middle attack against data integrity.

Recommendations For Dr Trust ECG Pen version 2.00.08, consider disabling Bluetooth LE support until a secure pairing or security mechanism is implemented to prevent unauthorized access. Restrict access to the GATT server to minimize the risk of data sniffing and extraction. Avoid using the device for sensitive measurements until the issue is resolved.

Fix

Related Identifiers

CVE-2020-15486

Affected Products

Dr Trust Ecg Pen

References · 3

• https://osv.dev/vulnerability/CVE-2020-15486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15486 · Security Note
• https://payatu.com/advisory/lack-of-bluetooth-le-encryption-and-access-control-in-dr-trust-ecg-or-ekg-pen · Note