PT-2026-7469 · Zoll · Zoll Epcr

Published 2026-02-10 · Updated 2026-02-11 · CVE-2025-12699

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZOLL ePCR IOS application (affected versions not specified)

Description The application displays user-supplied data within a WebView without proper sanitization. Specifically, attacker-controlled strings entered into PCR fields such as run number, incident, call sign, and notes are interpreted as HTML/JavaScript when the application prints or renders the content. This allows for the injection of scripts that can read local files from the application’s runtime context. These files contain device and user data, including protected health information (PHI) and device telemetry, potentially exposing sensitive information to an attacker. The proof of concept demonstrates the ability to retrieve local file content using injected scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-538

Related Identifiers

CVE-2025-12699

Affected Products

Zoll Epcr

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12699 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-041-01.json · Note
• https://twitter.com/VulmonFeeds/status/2021434425876058450 · Twitter Post
• https://cisa.gov/news-events/ics-medical-advisories/icsma-26-041-01 · Note
• https://zolldata.com/contact-us. · Note
• https://t.me/CVEtracker/44354 · Telegram Post