Unauthenticated BLE measurement-flood denial of service

1. Summary

The QardioARM A100 blood-pressure monitor exposes a writable Bluetooth Low Energy (BLE) GATT characteristic that accepts the “start measurement” command with no rate-limiting and no session/state guard, over an unencrypted radio link. Because nothing throttles or gates the write, an attacker within BLE proximity can repeatedly re-issue the command against the characteristic. CISA frames the trigger as unauthenticated and adjacent (BLE-range) with no user interaction, over the unencrypted BLE link, against the affected app and firmware versions [1][2]. The operational impact of sustaining this flood is analyzed in §6.

2. Affected products & versions

Note: CISA scopes the hardware as “QardioARM A100” specifically, while NVD lists “QardioARM (all versions)”; whether other QardioARM hardware is affected is not resolvable from public advisories [1][2].

3. The vulnerability in detail

The flaw lives in the QardioARM A100’s BLE GATT interface — the wireless command surface the cuff exposes to the Qardio Heart Health iOS and Android companion apps — and in the firmware behind it. The device advertises under the BLE name “QardioARM” and offers a writable characteristic identified by UUID 583CB5B3-875D-40ED-9098-C39EB0C1983D. Writing the two-byte payload f101 (hex) to that characteristic is the “start measurement” command: it tells the cuff to begin inflating and taking a reading [3]. This is normal, intended functionality — the companion app issues exactly this write when a user starts a measurement.

The actual defect is what the firmware does not do around that command. The characteristic accepts the start-measurement write with no rate-limiting, no debounce, and no connection/session state guard that would reject a new measurement while one is already in progress or while the motor is active. In a correctly hardened design, the firmware would gate this command behind a state machine — refusing a fresh f101 while a measurement cycle is running, or bounding how often the command can be honored per connection — so that a second write during an active cycle is a no-op rather than a re-trigger. Concretely, such a guard would need three things the firmware lacks: (a) a “busy”/measurement-in-progress flag that the command handler checks before actuating the pump, (b) a per-connection command budget or minimum inter-command interval enforced in firmware rather than trusting the well-behaved app, and (c) a link-layer requirement (encryption/bonding) that would at least raise the bar for an arbitrary peer to reach the write path at all. None of those guards is present. Combined with the fact that the BLE link is unencrypted and — per CISA’s framing — reachable without authentication or pairing, this means any BLE peer in range can drive the command as fast as it can issue writes [1][2]. Each write re-triggers the inflation motor and enqueues another request for the microcontroller to process. Because nothing throttles or gates these writes, an attacker can hold the motor on and keep the microcontroller busy servicing the flood [3].

The mechanism is a classic resource-exhaustion / command-flood denial-of-service. The trigger is simple: scan for the “QardioARM” peripheral, connect over BLE, and issue repeated Write operations of f101 to the target characteristic. Each individual write is indistinguishable from a legitimate “start measurement” issued by the app — the abuse is purely in the rate and repetition that the firmware fails to bound, not in any malformed or privileged input. The researcher’s proof-of-concept loops this write roughly 20,000 times with about half a second between writes, which is enough to keep the cuff continuously inflating and to keep the device saturated servicing the request stream [3]. While the device is in this state it cannot service a legitimate connection from the Heart Health app [1][2][3].

Preconditions, per CISA, are modest: the attacker must be within BLE radio range (adjacent network, AV:A; the issue is explicitly not remotely exploitable over a network), needs no privileges (PR:N), and needs no user interaction (UI:N), operating over the unencrypted BLE link against the affected app/firmware versions [1][2]. There is an important unresolved conflict here: the researcher’s own writeup states that “pairing is required to send commands,” which sits uneasily against CISA/NVD’s unauthenticated PR:N characterization [3][1][2]. If pairing is in fact required, the practical bar to exploitation is higher than the CISA framing implies; the sources cannot be reconciled on this point.

Step-by-step, the exploitation chain is:

1. The attacker positions within BLE radio range of a target QardioARM A100 (RF adjacency; no network path) [1].
2. A Python bleak script scans for the peripheral advertising as “QardioARM” [3].
3. The script establishes a BLE GATT connection over the unencrypted link [3].
4. It writes the start-measurement command f101 to characteristic 583CB5B3-875D-40ED-9098-C39EB0C1983D [3].
5. It repeats the write in a tight loop (PoC: ~20,000 iterations, ~0.5s apart) to sustain the flood [3].
6. The inflation motor runs continuously and the microcontroller is saturated processing the requests [3].
7. The Heart Health / clinician app can no longer connect [1][2][3].

Proof-of-concept status: a public researcher PoC exists (n0ps), implementing exactly the loop above; CISA and NVD both describe the attack as achievable via a “specially crafted Python script” [1][2][3].

On the CWE: CISA and NVD assign CWE-248: Uncaught Exception, which describes a condition where code raises an exception that is not caught, driving the program into an unexpected or failed state. The implication is that the command flood pushes the firmware into an unhandled failure state rather than merely keeping it busy. This is a weak fit for what the sources actually demonstrate. The researcher describes continuous motor operation plus microcontroller saturation — i.e., resource exhaustion / an unguarded, rate-unlimited command path — not a specific caught-or-uncaught exception, and no source exhibits the exception itself [3]. As an analytical matter, a resource-exhaustion classification along the lines of CWE-400 (uncontrolled resource consumption) or CWE-770 (allocation of resources without limits) would describe the observed behavior more faithfully. CWE-248 is CISA’s label [1][2]; the researcher writeup does not exhibit an exception [3].

4. Discovery & timeline

The vulnerabilities were reported to CISA by Bryan Riggins of Insulet Corporation [1][4]. The original technical reverse-engineering disclosure and the working PoC were published independently by researcher n0ps at n0psn0ps.github.io [3].

• 2025-02-13 — CISA advisory ICSMA-25-044-01 initial publication [1]; researcher writeup published the same day [3]; NVD CVE record published [2].
• 2026-06-17 — NVD record last modified [2].
• The researcher notes roughly 5+ months elapsed before CVE publication and that Qardio was ultimately unresponsive to disclosure [3]. Precise vendor-notification and coordinated-disclosure dates are not documented in the available sources.

Vendor response: Qardio did not respond to CISA’s requests to collaborate on remediation, and the company subsequently declared bankruptcy, so no patch was ever produced [1][3][4].

5. Technical reference

• CVE: CVE-2025-24836 (the DoS). Part of a three-CVE advisory alongside CVE-2025-20615 (CWE-359 information exposure) and CVE-2025-23421 (CWE-552 files/directories accessible / firmware access) [1].
• CWE: CWE-248 Uncaught Exception (as assigned by ICS-CERT/NVD) [1][2]. See §3 for why this is a contested fit.
• CVSS — CISA [1]:
• v3.1: 7.1 HIGH — AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
• v4.0: 7.2 HIGH — AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
• CVSS — NVD [2]:
• v3.1: 7.1 HIGH — AV:A/AC:H/...
• v4.0: 6.1 MEDIUM — AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H
• What the key metrics mean here: AV:A (adjacent) captures that the attacker must be in BLE radio range, not on the internet — this is the single most important limiter. PR:N/UI:N reflect CISA’s unauthenticated, no-interaction framing (contested by source [3]). VA:H/A:H is the high availability impact, while confidentiality/VC:L is minor. The CISA and NVD v4.0 vectors disagree on Attack Complexity (AC:L vs AC:H) and therefore on both score and band (7.2 HIGH vs 6.1 MEDIUM); this is an unresolved discrepancy between the two authoritative sources.
• Code/commit refs: no firmware source or patch exists. The load-bearing technical artifact is the researcher PoC and the characteristic/payload pair: write f101 to 583CB5B3-875D-40ED-9098-C39EB0C1983D [3].

6. Consequence & CFSE path analysis

Real-world consequence: while an attacker within BLE range actively runs the flood, the QardioARM A100 cannot pair with its app and cannot take a blood-pressure reading, and the cuff inflates continuously. This is the availability/denial-of-service impact that defines this CVE: a clinician or patient is blocked from taking a reading and must intervene [1][2][3]. It is a bounded operational and safety nuisance plus an availability outage of a single device. The sources describe availability/DoS impact only; no source confirms actual patient injury from over-inflation, so severe-injury or wrong-therapy consequences are not established [1][3][4]. Recovery is routine and local — disconnect the attacker, move out of range, or remove the battery.

Why the CFSE Path Score differs from CVSS: CVSS (7.1 HIGH / 7.2 HIGH) is anchored on the high availability metric and the medical context. The CFSE path reasons about the terminal consequence and the authority actually gained, which is narrower: bounded command authority over one cuff, no cross-domain authority transfer, and trivial local recovery. That produces an ELEVATED band that is deliberately more measured than a raw “HIGH” reading — hence direction OVER relative to the published CVSS baseline.

The CFSE path verdict below is reproduced in full. Two figures inside it — the “~10m” proximity and the RE:2 “no pairing” authority — are analytical assumptions not stated in public advisories; source [3] in fact asserts pairing is required:

Verdict: ELEVATED. The entry models a single risk path with terminal type DEVICE_AVAILABILITY (family: recovery), banded ELEVATED, which is also the dominant path and the overall path_verdict (ELEVATED, direction OVER relative to the published CVSS baseline). The path reasons that an attacker within BLE proximity (~10m) with no pairing or authentication (RE:2) can run a simple connect-and-write bleak script (EC:4) to repeatedly invoke the unauthenticated startMeasurement command, forcing continuous cuff inflation and blocking legitimate clinical readings. The consequence is scored as a bounded operational/safety nuisance and availability outage (PH:2) rather than credible severe injury or wrong-therapy, with only bounded command authority over the cuff (AT:2), minor data exposure (DP:1), and a single bounded physical/device boundary crossing that does not transfer authority across domains (CH:1). Reuse is product-class portable (SR:3) but execution is proximity-bound per device rather than remote/fleet-scale (SX:2), and recovery is routine and local via disconnect/battery removal (OR:1). The condition is documented/reproduced (EV:3, HISTORICAL) with no in-the-wild exploitation and no perception-feeds-action dynamic, so the base ELEVATED band is retained as final with no cap or systemic uplift.

7. Remediation & mitigations

There is no vendor patch and none is forthcoming — Qardio did not engage with CISA and has since declared bankruptcy [1][3][4]. Remediation is therefore operational only, and specific to this BLE-proximity command-flood:

• Disable Bluetooth on the device when it is not actively taking a measurement, so there is no advertising “QardioARM” peripheral for an attacker to connect to and flood [1][4]. This is the single highest-value control, because the entire attack surface is the writable characteristic reachable only while the device is discoverable/connectable.
• Do not operate the device in public spaces or within BLE range of untrusted parties — since the attack requires RF proximity (AV:A) and no network path, physically controlling who is in range is the primary defense [1][4].
• Use only the trusted Heart Health apps from trusted providers [1][4].
• Given the vendor’s insolvency and the “all versions/all firmware” scope, fleet operators (e.g., clinics) should treat the device as unpatchable and consider replacement where continuous BLE availability in shared/public spaces is required [1].
• Detection, where feasible, would look for anomalous repeated GATT writes of f101 to characteristic 583CB5B3-...C1983D from a single peer — the signature of this specific flood. But the device itself offers no logging or hardening, so this is only actionable with an external BLE monitor, not on-device [3].

8. Sources

[1] ICS Medical Advisory ICSMA-25-044-01: Qardio Heart Health iOS/Android Application and QardioARM A100 — CISA / ICS-CERT — https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01 — Authoritative coordinating advisory: all three CVEs, CWE-248, affected versions, both CVSS vectors, researcher credit, DoS mechanism, and mitigations. Credibility: primary-advisory.

[2] NVD — CVE-2025-24836 Detail — NVD (NIST) — https://nvd.nist.gov/vuln/detail/CVE-2025-24836 — Canonical CVE record: DoS description, CWE-248, both CVSS scores/vectors (v4.0 6.1 MEDIUM here), ICS-CERT as assigner. Credibility: primary-advisory.

[3] Reversing the QardioArm — n0ps (independent researcher) — https://n0psn0ps.github.io/2025/02/13/Reversing-the-QardioArm/ — Original technical disclosure and root cause: BLE characteristic UUID + f101 payload, the ~20,000-write bleak PoC, the motor-flood/microcontroller-saturation mechanism, the pairing-required claim, and Qardio’s non-response/bankruptcy. Credibility: researcher-primary.

[4] Zero-Day Flaws Found in Qardio Heart Health iOS & Android Apps — CyberInsider — https://cyberinsider.com/zero-day-flaws-found-in-qardio-heart-health-ios-and-android-apps/ — Independent press synthesis of all three CVEs; confirms DoS framing, researcher credit, vendor non-response, no in-the-wild exploitation, and CISA mitigations. Credibility: reputable-press.

[5] High-Severity Qardio App Vulnerability (CVE-2025-24836) Puts Personal Health Data at Risk — IntegSec — https://integsec.com/blog/high-severity-qardio-app-vulnerability-cve-2025-24836-puts-personal-health-data-at-risk — Analyst blog adding context on plist credentials, the hex-command engineering panel, and HIPAA/GDPR framing. Secondary/analyst quality. Credibility: reputable-press.

[6] CVE-2025-24836 — CVEDetails (SecurityScorecard) — https://www.cvedetails.com/cve/CVE-2025-24836/ — Aggregator mirror of NVD/ICS-CERT; corroborating cross-reference only, superseded by [1][2]. Credibility: low.