CVE-2025-20615

The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.

• CWE-359

• https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01US Government Resource
• https://www.qardio.com/about-us/#contactProduct

Published

Feb 13, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2060A vulnerability was found in PHPGurukul Emergency Ambulance …9.8
• CVE-2025-2061A vulnerability was found in code-projects Online Ticket Res…6.1
• CVE-2025-20611Exposure of sensitive information to an unauthorized actor f…5.7
• CVE-2025-20612Incorrect execution-assigned permissions for some Edge Orche…5.5
• CVE-2025-20613Predictable Seed in Pseudo-Random Number Generator (PRNG) in…3.3
• CVE-2025-20614External control of file name or path for some Intel(R) CIP …6.7
• CVE-2025-20616Uncontrolled resource consumption for some Edge Orchestrator…5.5
• CVE-2025-20617Improper neutralization of special elements used in an OS co…7.2
• CVE-2025-20618Stack-based buffer overflow for some Intel(R) PROSet/Wireles…8.3
• CVE-2025-2062A vulnerability classified as critical has been found in pro…9.8
• CVE-2025-20620SQL Injection vulnerability exists in STEALTHONE D220/D340 p…7.5
• CVE-2025-20621Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0…7.5