CVE-2025-24318 Dario Health CVE debrief

Who should care

People who use or administer the Dario Health Android mobile application, especially environments that rely on the app for health-data access or session-based authentication. Mobile app security and operations teams should also review the advisory because the impact depends on interaction with XSS and session handling.

Technical summary

According to the CISA CSAF advisory, the Android application exposes cookie policy information through built-in browser tools. That exposure is not described as a standalone exploit by itself; the advisory specifically warns that if an attacker can also leverage XSS, the result could be full session compromise. The source advisory lists the affected product family as the Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Applications and includes mitigations focused on updating from trusted sources, avoiding rooted/jailbroken devices, and avoiding public untrusted networks.

Defensive priority

Medium. The advisory is publicly disclosed and rated CVSS 6.8, but the stated worst case is serious because XSS plus cookie/session exposure could lead to full session compromise. Prioritize updating the app and validating session and browser security controls.

Recommended defensive actions

• Update the Dario Health Android mobile application to the latest version from trusted sources.
• Avoid using rooted or jailbroken devices with the application.
• Avoid public untrusted networks when using the app.
• If you manage the app or related web components, review XSS protections and session-cookie handling.
• Contact Dario Health for product-specific guidance if needed.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSMA-25-058-01 for CVE-2025-24318, published on 2025-02-27. The advisory text states: 'Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromise.' The advisory also recommends updating the Android application to the latest version and lists additional user mitigations. No KEV entry was provided in the source corpus.

Official resources