CVE-2025-24836: Qardio Heart Health Android Mobile Application

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected device. This would prevent the device from connecting to a clinician's app to take patient readings and ostensibly flood it with requests, resulting in a denial-of-service condition.

Affected products

• Qardio Heart Health Android Mobile Application: version 2.5.1 only
• Qardio Heart Health IOS Mobile Application: version 2.7.4 only
• Qardio Qardioarm: any version

Published 2025-02-13. Last modified 2026-06-17.