CVE-2025-20615: Qardio

Medium severity, CVSS 6.6. EPSS: 0.2% chance of exploitation in the next 30 days.

The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.

Affected products

• Qardio Qardio: version 2.7.4 only

Published 2025-02-13. Last modified 2026-06-17.