CVE-2025-20060
Published: 28 February 2025
Summary
CVE-2025-20060 is a high-severity Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) vulnerability in Cisa (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-19 (Access Control for Mobile Devices) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to the Dario Health application database, preventing remote unauthenticated attackers from exposing cross-user PII and personal health information.
Implements cryptographic protection for PII and personal health information at rest in the application database, mitigating disclosure even if unauthorized access occurs.
Controls connections, usage, and access for mobile devices and applications like Dario Health on Android, restricting exploitation of database vulnerabilities remotely.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote unauthenticated access to sensitive data in the app database (T1190) and directly facilitates collection of local stored information (T1005).
NVD Description
An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android device via the Dario Health application database.
Deeper analysisAI
CVE-2025-20060 is a vulnerability in the Dario Health application on Android devices that enables an attacker to expose cross-user personal identifiable information (PII) and personal health information transmitted to and stored in the application's database. Published on 2025-02-28, it is associated with CWE-359 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact from remote exploitation with low complexity and no authentication or user interaction required.
Remote attackers require no privileges and can exploit the vulnerability over the network to read sensitive cross-user PII and personal health data from the Dario Health app database on affected Android devices, potentially compromising privacy for multiple users without impacting integrity or availability.
Mitigation guidance is available in the CISA ICS Medical Advisory ICSMA-25-058-01 at https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01, with additional support via Dario Health at https://www.dariohealth.com/contact/.
Details
- CWE(s)