PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-53683 Ossur CVE debrief

A medium-severity vulnerability in the Össur Logic Mobile Application (versions prior to 1.5.5) exposes hardcoded credentials and a static authentication token within decompiled application code. An attacker with local access and elevated privileges could leverage these artifacts to modify translation files, undermining application integrity and disrupting normal medical device operation. The vulnerability stems from insecure credential storage in JavaScript files within the iOS application package (IPA), a common anti-pattern in mobile healthcare applications where client-side code obfuscation is mistakenly relied upon for security. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) reflects the local attack vector, high privilege requirements, and high integrity impact without confidentiality or availability compromise. CISA published this advisory on December 19, 2024, as ICSMA-24-354-01. No known exploitation in ransomware campaigns has been reported.

Vendor
Ossur
Product
Logic Mobile Application
CVSS
MEDIUM 4.4
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-19
Original CVE updated
2024-12-19
Advisory published
2024-12-19
Advisory updated
2024-12-19

Who should care

Healthcare organizations using Össur medical devices with mobile app integration; clinical engineering teams managing orthopedic device deployments; mobile application security teams in healthcare technology sectors; compliance officers evaluating FDA cybersecurity guidance adherence for medical device software

Technical summary

The Össur Logic Mobile Application, used in conjunction with medical devices, contains a valid set of credentials stored in a JavaScript file and a static communication token embedded within the iOS application package (IPA). These security artifacts can be extracted through standard IPA decompilation techniques. An attacker with local device access and administrative privileges could utilize these credentials to authenticate to backend services and modify translation files, compromising the integrity of application functionality. The vulnerability is classified as medium severity (CVSS 3.1: 4.4) due to the local attack vector and high privilege requirements, though the integrity impact is rated high. The attack does not enable data exfiltration or service disruption directly, but manipulated translations could mislead users or alter device configuration workflows.

Defensive priority

medium

Recommended defensive actions

  • Update Össur Logic Mobile Application to version 1.5.5 or later through official app stores
  • Verify application version in device settings post-update
  • Review mobile device management policies to enforce automatic application updates for medical device companion apps
  • Conduct code review of other healthcare applications for similar hardcoded credential patterns
  • Implement runtime application self-protection (RASP) controls where available to detect tampering attempts

Evidence notes

The advisory confirms credentials and static tokens were recoverable through IPA decompilation, with translation file modification identified as the primary attack pathway. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) corroborates the integrity-focused impact assessment.

Official resources

CISA ICS Medical Advisory ICSMA-24-354-01, published December 19, 2024