AliveCor KardiaMobile
Successful exploitation of these vulnerabilities could lead to attackers stealing or faking personal cardiograms or enabling a denial-of-service attack. Attackers must be at close range to carry out these attacks.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-41627US | high7.6OT elevated | — | ||
The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocols. Exploiting this vu… | ||||
| CVE-2022-40703US | medium6.1 | — | ||
CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior
on Android allows an unauthenticated attacker with physical acce… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSMA-22-298-01 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSMA-22-298-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (2)
- MitigationKardia App Android application
The Kardia App usage instructions include recommendations for users to use passcode (PIN) or biometric identification for their smartphone devices; such measures greatly reduce the risk of Intent Manipulation.
- MitigationKardiaMobile IoT device
AliveCor has acknowledged that the data-over-sound protocol has no encryption and is vulnerable to CVE-2022-41627, but the circumstances necessary for exploitation are "unlikely."
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan