CVE-2020-15486: Drtrust Electrocardiogram Pen Firmware

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered on Dr Trust ECG Pen 2.00.08 devices. Because the Bluetooth LE support is implemented without a requirement for pairing or security, any attacker can access the GATT server of the device and can sniff the data being broadcasted while a measurement is being done. Also, saved data can also be extracted over a Bluetooth connection. In addition, an attacker can launch a man-in-the-middle attack against data integrity.

Affected products

• Drtrust Electrocardiogram Pen Firmware: version 2.00.08 only

Published 2020-08-26. Last modified 2026-06-17.