Qardio Heart Health IOS and Android Application and QardioARM A100 Uncaught Exception
With a specially crafted Python script, an attacker could send
continuous startMeasurement commands over an unencrypted Bluetooth
connection to the affected device. This would prevent the device from
connecting to a clinician's app to take patient readings and ostensibly
flood it with requests, resulting in a denial-of-service condition.
Qardio Heart Health IOS and Android Application and QardioARM A100 Uncaught Exception
With a specially crafted Python script, an attacker could send
continuous startMeasurement commands over an unencrypted Bluetooth
connection to the affected device. This would prevent the device from
connecting to a clinician's app to take patient readings and ostensibly
flood it with requests, resulting in a denial-of-service condition.
Qardio has not responded to requests to work with CISA to mitigate these
vulnerabilities. Users of these affected products are invited to
contact Qardio customer support https://www.qardio.com/about-us/#contact for additional information.
Users should do the following to help mitigate the risk:
* Disable Bluetooth when not in use.
* Don't use this device in public or within Bluetooth range of malicious actors.
* Only use trusted mobile apps from trusted providers.
Exploits
Credits
finder
Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA.
With a specially crafted Python script, an attacker could send
continuous startMeasurement commands over an unencrypted Bluetooth
connection to the affected device. This would prevent the device from
connecting to a clinician's app to take patient readings and ostensibly
flood it with requests, resulting in a denial-of-service condition.