Static engineering credentials exposed in a mobile application

1. Summary

The Qardio Heart Health iOS application (v2.7.4) for the QardioARM A100 blood-pressure monitor ships a property-list (.plist) resource inside its distributed app bundle that contains hardcoded, production-level (“dev account”) usernames and passwords [1][2]. Because the same secrets are baked into every downloadable copy of the app, anyone who decrypts the IPA can read them and authenticate to production development accounts [1][4]. Those accounts in turn unlock a hidden in-app “Engineering” backdoor that can issue raw hex commands to the device over Bluetooth Low Energy (BLE), yielding a privileged device-command surface that a consumer app should never expose [1][4].

2. Affected products & versions

Note: CVE-2025-20615 proper is scoped by NVD/MITRE to the iOS app v2.7.4 [1][2]. The Android app and device are listed in the bundling CISA advisory ICSMA-25-044-01 because the same reverse-engineering effort produced two companion CVEs (CVE-2025-23421, CVE-2025-24836) [3].

3. The vulnerability in detail

The defect lives entirely in a client-distributed artifact: the Qardio Heart Health iOS application bundle, version 2.7.4, as anyone can download it from the App Store [1][4]. Inside that bundle is a .plist (property-list) resource file, and inside that plist are one or more sets of production-level usernames and passwords — described in the researcher writeup as “more than one set” of production/“dev account” credentials [4]. These are not per-user secrets provisioned at runtime; they are static values compiled into the shipped app, identical in every copy distributed to every user. This is the essential shape of the bug: a secret that must be trusted has been placed on the client side of the trust boundary, where the client is fully attacker-controlled.

The root cause is exposure of secrets in a client-distributed artifact rather than keeping authentication server-side [4]. A well-designed mobile app authenticates the user against a server and never carries a standing production/engineering credential in the binary. Qardio instead embedded reusable production credentials directly in the app bundle. This is compounded by a second design defect that turns the leaked credential into real authority: the app contains a hidden “Engineering” code path — a Qardio.AppRoutes route and an -[Engineering init] class / engineering panel — that these credentials unlock [4]. The engineering panel exposes a UI terminal capable of sending commands to the QardioARM A100 device. So the leaked secret is not merely a login; it is the key to a privileged device-command surface that should never have been reachable from a shipped consumer app.

Mechanism and trigger. The attacker needs only the freely downloadable app plus the ability to strip Apple’s FairPlay DRM from the IPA and inspect the bundle’s resources [4]. iOS app binaries are encrypted at rest, but decrypting a downloaded IPA (e.g., on a jailbroken device or with standard tooling) is routine, well-documented reverse-engineering work — not a novel exploit primitive. Once decrypted, the plist is a plaintext resource; the attacker reads the embedded credential sets directly [4]. Those credentials authenticate to production-level development accounts, which flips the app into a state where the hidden Engineering panel is available. From that panel’s UI terminal, the attacker issues hex-based commands to the device [1][4]. The researcher demonstrated the underlying device-command surface concretely by writing to BLE GATT characteristic 583CB5B3-875D-40ED-9098-C39EB0C1983D using commands 0xf101 and 0xf102, where 0xf101 corresponds to start-measurement / motor operation [4]. Reaching the device over BLE additionally requires RF adjacency to a QardioARM A100, and — importantly — no firmware-side authentication gates the BLE command characteristic [4].

Exploitation chain, step by step [4]:

1. Download the publicly available Qardio Heart Health iOS app (v2.7.4).
2. Decrypt the IPA to remove FairPlay encryption and expose bundle resources.
3. Locate the .plist in the bundle and read the embedded production username/password sets.
4. Authenticate to a production-level development account using the extracted credentials.
5. Gain access to the hidden “Engineering” backdoor panel (Qardio.AppRoutes / Engineering class).
6. Use the engineering terminal to send raw hex commands to the QardioARM A100 over BLE (characteristic 583CB5B3-..., commands 0xf101/0xf102).
7. Optionally weaponize: a public PoC Python (Bleak) script writes 0xf101 ~20,000 times to force continuous motor/cuff operation.

Worth distinguishing: the backdoor panel can also be forced open at runtime with Frida instrumentation — on iOS by hooking MenuCollectionViewDataSource '- items' to inject an EngineeringMenuItem, and on Android by flipping a boolean in com.getqardio.android.mvp.MvpApplication [4]. But that requires local instrumentation of the app. The CVE-2025-20615 defect proper is narrower and worse: valid credentials read straight from the plist grant this engineering authority without any such runtime trick [4].

Proof-of-concept status. A public technical reverse-engineering writeup (n0ps blog, 2025-02-13) exists with concrete artifacts: Frida scripts to enable the backdoor on iOS and Android, the BLE characteristic UUID, the hex commands, and a working PoC Python (Bleak) flooding script [4]. That flooding PoC directly demonstrates the companion BLE DoS (CVE-2025-24836) reachable through the same device-command surface [4][6]. For CVE-2025-20615 specifically, the researcher deliberately withheld the exact plist filename and the actual credential strings (“I will leave that exercise to the reader”) [4].

The underlying weakness (CWE-359). The vulnerability is tagged CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), with NVD additionally applying NVD-CWE-Other [1]. Sensitive information that should have been kept from unauthorized parties — here, production authentication credentials — is exposed to anyone in possession of the widely distributed app. Conceptually this also overlaps strongly with the “use of hard-coded credentials” family, since the exposed secret is a static, embedded credential rather than user data; but the assigned classification is CWE-359 [1].

4. Discovery & timeline

• Finder: Bryan Riggins of Insulet Corporation, reported to CISA [2][5].
• CVE published: 2025-02-13 (MITRE/NVD; assigner ICS-CERT) [1][2].
• Researcher writeup published: 2025-02-13 (n0ps, “Reversing the QardioArm”) [4].
• CISA advisory ICSMA-25-044-01 issued: 2025-02-13, bundling CVE-2025-20615, CVE-2025-23421, and CVE-2025-24836 [3].
• Disclosure duration: the researcher describes coordinated disclosure spanning “5+ months” with an unresponsive vendor [4].
• Vendor response: Qardio did not respond to CISA; the company subsequently became unresponsive / went bankrupt, so no patch was produced [3][5].
• NVD last modified: 2026-06-17 [1].

5. Technical reference

• CVE: CVE-2025-20615 (part of CISA advisory ICSMA-25-044-01) [1][3].
• CWE: CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor); NVD also tags NVD-CWE-Other [1].
• CVSS v3.1 — dual scores:
• NIST: 6.6 (Medium) — CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [1].
• ICS-CERT CNA: 6.2 (Medium) — CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L [1][2].
• What the key metrics mean here: Both baselines use AV:P (Physical), modeling the vulnerable component as an installed phone that an attacker must physically/locally access, and PR:L (low privileges). UI:N means no victim interaction. The two scores differ only on Availability: NIST rates A:H (reflecting the device-command/DoS reach), ICS-CERT rates A:L. The AV:P metric is the dominant suppressor pulling both scores into the Medium band. See Section 6 for why that modeling choice is contestable given the credential is read from the distributed app artifact, not from a victim’s phone.
• Code / device refs: BLE GATT characteristic 583CB5B3-875D-40ED-9098-C39EB0C1983D; hex commands 0xf101 (start measurement / motor) and 0xf102 (function unspecified in sources); iOS classes Qardio.AppRoutes, -[Engineering init], MenuCollectionViewDataSource, EngineeringMenuItem; Android com.getqardio.android.mvp.MvpApplication [4].
• CVSS v4 vectors: the CISA advisory lists v4 vectors; the specific v4 vector strings are not documented in NVD or MITRE [3].

6. Consequence & CFSE path analysis

Real-world consequence: A single extraction of the app yields a portable, fleet-wide-reusable production credential that grants standing engineering-backdoor authority. Because the same static secret ships in every distributed copy of the app, one attacker who decrypts one IPA obtains a credential that works everywhere, indefinitely, until the vendor rotates it — and no vendor patch exists to do so [1][3][4]. That credential bridges into a privileged device-command surface capable of driving the QardioARM A100 over BLE (e.g., forcing continuous cuff/motor operation) [4].

Why the CFSE Path Score diverges from CVSS. The CFSE analysis reaches the following verdict:

Verdict: CRITICAL. The analysis models a single dominant consequence path, “account-authority,” with terminal type ACCOUNT_AUTHORITY, banded CRITICAL. The path chain: a production engineering credential can be read from an attacker-owned copy of the downloadable Qardio Arm iOS app (stored in a .plist), which bridges into the vendor API (api.getqardio.com) and an engineering backdoor capable of issuing raw hex commands to the device over BLE. The scoring emphasizes blast-radius/scale-of-reuse (dimension #1): the same static credential is embedded in every distributed app copy, so one extraction yields a portable, fleet-wide reusable secret granting standing engineering-backdoor authority. The analysis argues the published NVD/CISA Medium baselines (6.6 / 6.2, with AV:P as the suppressor) understate the real risk because they model the vulnerable component as a victim’s installed phone rather than the distributed app artifact read from the attacker’s own device (which would be AV:N/PR:N). Recovery is scoped as coordinated operational work: rotating the production secret, removing it from distributed app copies, and verifying dependent services.

The crux of the divergence is the modeling of the vulnerable component. CVSS AV:P treats the attacker as needing physical access to a victim’s phone. But the secret is not extracted from a victim’s phone — it is extracted from the attacker’s own downloaded copy of a publicly distributed artifact. Modeled that way, reading the credential is effectively AV:N / PR:N: no victim, no privilege, no proximity. CVSS’s AV:P suppressor therefore understates reachability. CFSE additionally scores blast radius (dimension #1): a static secret identical across the entire distributed fleet means one extraction confers reusable, standing authority at fleet scale — a property CVSS’s per-instance base metrics do not capture. Hence CRITICAL under CFSE versus Medium under both published CVSS baselines.

Caveat: the api.getqardio.com API bridge named in the path chain above is not corroborated by any public source (not documented in the researcher writeup, NVD, or MITRE). The credential-to-backdoor-to-BLE chain is corroborated; the vendor-API hop is not.

7. Remediation & mitigations

There is no vendor patch — Qardio did not respond to CISA and is unresponsive/bankrupt [3][5]. Remediation is therefore split between the (theoretical) vendor fix and the operational mitigations users can actually apply.

Vendor-side fix (what should be done, specific to this bug) [4][remediation]:

• Rotate/revoke the exposed production credentials — they are compromised the moment the plist is read.
• Remove the secrets from the distributed app bundle and move authentication server-side so no standing production credential ships in the client.
• Disable or gate the “Engineering” backdoor (Qardio.AppRoutes / Engineering) in shipped consumer builds so it is unreachable even with valid credentials.
• Verify dependent services after rotation (anything the production accounts touch).
• Consider adding firmware-side authentication on the BLE command characteristic, since it currently accepts commands ungated — this closes the device leg the backdoor bridges into [4].

Operational mitigations for users (CISA guidance, applicable here because no patch exists) [3][5]:

• Disable Bluetooth when the device is not in use (removes the BLE reachability the backdoor depends on).
• Avoid using the device in public spaces where an attacker could maintain BLE proximity.
• Install apps only from trusted sources.

8. Sources

[1] NVD - CVE-2025-20615 — NVD / NIST — https://nvd.nist.gov/vuln/detail/CVE-2025-20615 — Authoritative record: full description, CWE-359, dual CVSS v3.1 scores (NIST 6.6 vs ICS-CERT 6.2), affected iOS 2.7.4, CNA = ICS-CERT — primary advisory.

[2] CVE-2025-20615 — MITRE / CVE.org (cveawg API; assigner icscert) — https://cveawg.mitre.org/api/cve/CVE-2025-20615 — Canonical CVE record: publish date 2025-02-13, finder attribution (Bryan Riggins, Insulet), ICS-CERT CNA CVSS vector, full backdoor/hex-command description — primary advisory.

[3] Qardio Heart Health iOS and Android Application and QardioARM A100 (ICSMA-25-044-01) — CISA (ICS Medical Advisory) — https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01 — Government advisory bundling the three CVEs, affected products/versions, CWE mappings, CVSS vectors, mitigation guidance, and note that Qardio did not respond — primary advisory (contents corroborated via [1][2]).

[4] Reversing the QardioArm — n0ps (independent researcher blog) — https://n0psn0ps.github.io/2025/02/13/Reversing-the-QardioArm/ — Original technical writeup: IPA decryption, plist with multiple production credential sets, hidden Engineering class, Frida enable scripts (iOS/Android), BLE characteristic UUID, hex commands, and the 20,000-write PoC flooding script — researcher-primary.

[5] Zero-Day Flaws Found in Qardio Heart Health iOS & Android Apps — CyberInsider — https://cyberinsider.com/zero-day-flaws-found-in-qardio-heart-health-ios-and-android-apps/ — Press summary of all three CVEs; corroborates finder attribution, unpatched status, no public exploits, and CISA mitigation advice — reputable press.

[6] High-Severity Qardio Flaw (CVE-2025-24836) Risks Health Data — IntegSec — https://integsec.com/blog/high-severity-qardio-app-vulnerability-cve-2025-24836-puts-personal-health-data-at-risk — Press analysis of the companion BLE command-flooding DoS in the same cluster; context on the device-command/BLE surface the backdoor bridges into — reputable press.