CVE-2025-12699 ZOLL CVE debrief

Who should care

Healthcare IT, mobile device management, security, and privacy/compliance teams that may still have ZOLL ePCR iOS 2.6.7 installed on managed devices, retained in backups, or present in archived device images or test systems.

Technical summary

The advisory describes a WebView output-rendering flaw: untrusted PCR field content is reflected into a browser-like context and can be interpreted as HTML/JavaScript. That makes the app vulnerable to local client-side script execution in the app context, with the demonstrated impact being local file read exposure. The source material also references CWE-538 and lists a CVSS v3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (5.5).

Defensive priority

Medium overall, but higher priority if any residual installations or device images still exist because the impact is confidentiality loss of PHI/device data; if the app has already been fully removed everywhere, the practical exposure is largely historical.

Recommended defensive actions

• Confirm whether any ZOLL ePCR iOS 2.6.7 installations, backups, MDM profiles, or retained device images still exist in your environment.
• Remove the application from any remaining managed devices and quarantine or reimage endpoints if you cannot verify that no sensitive local data remains.
• Review stored PCR exports, cached records, and device-held artifacts for possible exposure of PHI or telemetry data, especially where rendered content may have been preserved.
• If the product is still present anywhere, prevent further use until you have completed an exposure assessment and documented data-handling impact for privacy and compliance teams.
• Use CISA's ICS recommended practices and defense-in-depth guidance to reduce the risk of future client-side rendering flaws in mobile or operational applications, including strict input/output handling and least-privile"

Evidence notes

The primary evidence is CISA's ICS Medical Advisory ICSMA-26-041-01 and its linked CSAF JSON for CVE-2025-12699, both published and modified on 2026-02-10. The source text states that ZOLL ePCR iOS reflects unsanitized user input into a WebView, that the proof of concept returns local file content, and that exposed files may contain PHI or device telemetry. The remediation note in the source says the app was decommissioned in May 2025 and that ZOLL has no current plans to provide a replacement application. The supplied source also includes a CVSS v3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N and a KEV value of false.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.