AliveCor KardiaMobile
Successful exploitation of these vulnerabilities could lead to attackers stealing or faking personal cardiograms or enabling a denial-of-service attack. Attackers must be at close range to carry out these attacks.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-41627US | high7.6OT erhöht | — | ||
The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocols. Exploiting this vu… | ||||
| CVE-2022-40703US | medium6.1 | — | ||
CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior
on Android allows an unauthenticated attacker with physical acce… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSMA-22-298-01 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSMA-22-298-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (2)
- MitigationKardia App Android application
The Kardia App usage instructions include recommendations for users to use passcode (PIN) or biometric identification for their smartphone devices; such measures greatly reduce the risk of Intent Manipulation.
- MitigationKardiaMobile IoT device
AliveCor has acknowledged that the data-over-sound protocol has no encryption and is vulnerable to CVE-2022-41627, but the circumstances necessary for exploitation are "unlikely."
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan