CVE-2025-23421 Qardio iOS and Android applications Files or Directories Accessible to External Parties
Attackers can access firmware files from Qardio mobile apps to reverse engineer hardware, compromising device confidentiality and integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-23421?
CVE-2025-23421 is a medium-severity vulnerability in Qardio Heart Health Android Mobile Application, published on 13 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enabled by the Qardio iOS and Android applications.
Weakness: CWE-552
Which versions are affected by CVE-2025-23421?
How do I fix CVE-2025-23421?
No fix has been published for CVE-2025-23421 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-23421 being exploited?
There is no known exploitation of CVE-2025-23421 in the wild and no public exploit code.
Sources
Also known as GHSA-gf6v-v2m7-4pr4.