PT-2025-7038 · Qardio · Qardio - Heart Health Ios Mobile Application

Bryan Riggins · Published 2025-02-13 · Updated 2025-02-16 · CVE-2025-24836

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Qardio - Heart Health IOS Mobile Application version 2.7.4

Description: The issue allows an attacker to send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected device, preventing it from connecting to a clinician's app to take patient readings and potentially flooding it with requests, resulting in a denial-of-service condition.

Recommendations: For Qardio - Heart Health IOS Mobile Application version 2.7.4, consider disabling the startMeasurement command functionality until a patch is available to prevent exploitation. Restrict access to the device over Bluetooth connections to minimize the risk of denial-of-service attacks.

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2025-24836

Affected Products

Qardio - Heart Health Ios Mobile Application

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-24836 · Security Note
• https://twitter.com/CVEnew/status/1890162443202261047 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1890259192004399169 · Twitter Post
• https://qardio.com/about-us/#contact · Note
• https://twitter.com/cybercronai/status/1891268961133572121 · Twitter Post
• https://cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01 · Note