CVE-2025-20049 Dario Health CVE debrief

Who should care

Patients, caregivers, and organizations using Dario Health’s Android application or related portal/server components should care, especially if they handle health data or manage monitored glucose information. Security and mobile app management teams should prioritize validation that the latest vendor update has been deployed.

Technical summary

The advisory describes an XSS condition in the Dario Health portal service application associated with the USB-C Blood Glucose Monitoring System Starter Kit Android applications. The published CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N, indicating network reachability, low privileges, user interaction, and potential confidentiality impact with scope change. The corpus does not provide the vulnerable parameter, payload pattern, affected version range, or a proof-of-concept, so the practical defensive takeaway is to patch the Android app and reduce exposure by following vendor guidance.

Defensive priority

Medium. The CVSS score is 5.8, and the impact described is confidentiality-focused rather than integrity or availability loss. That said, the data involved is sensitive health information, so timely application updates and basic environment hardening should be treated as important.

Recommended defensive actions

• Update the Dario Health Android mobile application to the latest vendor-provided version.
• Install updates only from trusted sources.
• Avoid using rooted or jailbroken devices with the application.
• Avoid public and otherwise untrusted networks when using the application.
• If you administer endpoints or mobile fleets, verify that the updated app version is installed and that the vendor guidance has been communicated to users.
• Contact Dario Health directly if you need clarification on remediation or deployment status.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory metadata for ICSMA-25-058-01 and the included vendor remediation notes. The advisory text explicitly states that the Dario Health portal service application is vulnerable to XSS and could allow an attacker to obtain sensitive information. The supplied record shows initial publication on 2025-02-27 and no KEV listing in the provided enrichment data. No affected-version range, exploit path, or proof-of-concept was included in the corpus.

Official resources