Causal model
What has to happen for this consequence to hold?
1 candidate path · explicit source, inference, and assumption boundaries.
Authority · Dominant path
Account authority
The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.
Reusable artifact or reachable service
The production secret can be read from an attacker-owned copy of the downloadable iOS app; no victim phone has to be seized.
EvidenceNVD
Reusable multi-stage bridge
A public app artifact yields a production credential, which bridges into the vendor API and then toward device command functions.
EvidenceNo direct citation — inspect the declared inference or assumption.
Administrative or command authority
The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.
EvidenceNo direct citation — inspect the declared inference or assumption.
Account authority
The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.
EvidenceNo direct citation — inspect the declared inference or assumption.
Coordinated operational recovery
Recovery requires rotating the production secret and removing it from distributed app copies, followed by verification of dependent services.
EvidenceNo direct citation — inspect the declared inference or assumption.
Decision rationale
Why this band?
The compact score is separated into the facts and judgments that produced it.
Reach and effort
- Reachability
RE 3 - Reusable artifact or reachable service
The production secret can be read from an attacker-owned copy of the downloadable iOS app; no victim phone has to be seized.
- Execution complexity
EC 4 - Straightforward operation
The engineering credential is stored in an application property list, so extraction is a direct file-inspection task.
- Exposure
EX 3 - Access position limits exposure
The technique is easier to perform than it is to position against a target, so access is the constraining factor.
Consequence
- Physical / safety
PH 0 - No direct physical effect
Reading the credential does not itself change blood-pressure measurement or cause a physical effect; BLE command delivery is a separate downstream step.
- Data / perception
DP 3 - Sensitive device or personal data
The exposed value is a production engineering credential, not ordinary app telemetry or a single user record.
- Authority
AT 3 - Administrative or command authority
The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.
Scale and recovery
- Chainability
CH 3 - Reusable multi-stage bridge
A public app artifact yields a production credential, which bridges into the vendor API and then toward device command functions.
- Reuse scale
SR 4 - Shared fleet-wide primitive
The same static credential is embedded in every downloadable app copy, so one extraction produces a portable secret.
- Execution scale
SX 4 - Remote fleet-scale execution
The engineering account is reusable across the deployed service without repeating extraction for each user, while BLE delivery remains local.
- Recovery burden
OR 3 - Coordinated operational recovery
Recovery requires rotating the production secret and removing it from distributed app copies, followed by verification of dependent services.
Confidence and status
- Evidence strength
EV 3 - Reproduced or strongly report-backed
NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.
- Liveness
LS Historical - Historical condition
The condition is retained as a historical case rather than a claim of current field exposure.
Decision trail
How the final band follows
- Base bandCRITICAL
- No adjustment
The CRITICAL base band remains final because no separate cap or systemic uplift applies. The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.
- Final candidate bandCRITICAL
Technical vector
CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:3/EC:4/EX:3/PH:0/DP:3/AT:3/CH:3/SR:4/SX:4/OR:3/EV:3/LS:HISTORICALRead the scoring method →Triage implication
Verify the authority transition before acting on the band.
Prioritize the trust boundary the path crosses, then verify which privileged identities, services, or firmware controls become reachable.
Evidence ledger
Public sources used by this record.
Every named source includes a public link. Path review remains separate from citation coverage.
- advisoryNVD
NVD
- advisory
Published baseline
Keep exploit severity and consequence reasoning distinct.
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LCVE recordsCVE-2025-20615
Original scorer notes
The source narrative behind the structured explanation.
Retained for provenance and historical review, not as the recommended way to understand the assessment.
Read the original scorer notes
TL;DR
The Paths model rates this CRITICAL because a single static credential shipped in every downloadable app copy yields production engineering authority across the deployed fleet. The published 6.2/6.6 Medium baseline is retained for source review; the Paths driver is fleet-scale authority transfer from a reusable app artifact.
What it is
The Qardio Arm iOS app ships static, production-level credentials in a .plist file. Extracting them unlocks an engineering/dev account on api.getqardio.com plus an engineering backdoor that issues raw hex commands to the cardiac-adjacent device over BLE. (CISA ICSMA-25-044-01.)
Published baseline — scope note
AV:P (Physical) is the suppressor. FIRST scores Attack Vector relative to the vulnerable component. The analyst modeled the component as “a victim’s installed phone,” requiring physical extraction. But the secret is identical in every downloadable copy — the real component is the distributed app artifact, read from the attacker’s own device. That is AV:N, and reading a file from your own app copy needs no privilege (PR:N). The CWE-359 (“private info exposure”) label also understates a privileged backdoor as a privacy leak.
Consequence driver
The Paths model highlights dimension #1 (blast-radius/scale-of-reuse): one extracted credential yields standing engineering-backdoor authority across the deployed fleet. The published baseline depends on a component model that treats the vulnerable artifact as a victim phone (AV:P). The leak is remote and reusable; kinetic BLE delivery remains local.
Sources
CFSE Consequence Paths Registry 1.0-candidate, CPATH-2026-0001 (“Qardio Arm — static credentials → engineering backdoor”), paths.cfse.ai/CPATH-2026-0001 (published 2026-06-03).