CVE-2020-15486 - An issue was discovered on Dr Trust ECG Pen 2.00.08 devices

Back Back to CVE browser

MEDIUM

An issue was discovered on Dr Trust ECG Pen 2.00.08 devices

Published Aug 26, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 0.51%

Description

An issue was discovered on Dr Trust ECG Pen 2.00.08 devices. Because the Bluetooth LE support is implemented without a requirement for pairing or security, any attacker can access the GATT server of the device and can sniff the data being broadcasted while a measurement is being done. Also, saved data can also be extracted over a Bluetooth connection. In addition, an attacker can launch a man-in-the-middle attack against data integrity.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7479
Advisory
https://payatu.com/advisory/lack-of-bluetooth-le-encryption-and-access-control-in-dr-trust-ecg-or-ekg-pen
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7479		Advisory
https://payatu.com/advisory/lack-of-bluetooth-le-encryption-and-access-control-in-dr-trust-ecg-or-ekg-pen		x_refsource_MISCThird Party Advisory