CVE-2025-20060 Information disclosure in Dario Application Database and Internet-based Server Infrastructure
An attacker can expose cross-user personal health information stored in the Dario Health Android application database.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-20060?
CVE-2025-20060 is a high-severity vulnerability in Dario Application Database and Internet-based Server Infrastructure, published on 28 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android device via the Dario Health application database.
Weakness: CWE-359
Which versions are affected by CVE-2025-20060?
How do I fix CVE-2025-20060?
No fix has been published for CVE-2025-20060 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-20060 being exploited?
There is no known exploitation of CVE-2025-20060 in the wild and no public exploit code.
Sources
Also known as GHSA-26gv-chv5-g7q6.