CVE-2025-24836 - Qardio Arm

Description

With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected device. This would prevent the device from connecting to a clinician’s app to take patient readings and ostensibly flood it with requests, resulting in a denial-of-service condition.

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01