ZOLL ePCR IOS Mobile Application 2.6.7 run number/incident/call sign/notes file information disclosure

Summaryinfo

A vulnerability classified as problematic has been found in ZOLL ePCR IOS Mobile Application 2.6.7. The impacted element is an unknown function. The manipulation of the argument run number/incident/call sign/notes leads to file information disclosure. This vulnerability is uniquely identified as CVE-2025-12699. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in ZOLL ePCR IOS Mobile Application 2.6.7 and classified as problematic. This issue affects some unknown processing. The manipulation of the argument run number/incident/call sign/notes with an unknown input leads to a file information disclosure vulnerability. Using CWE to declare the problem leads to CWE-538. The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information. Impacted is confidentiality. The summary by CVE is:

The ZOLL ePCR IOS application reflects unsanitized user input into a WebView. Attacker-controlled strings placed into PCR fields (run number, incident, call sign, notes) are interpreted as HTML/JS when the app prints or renders that content. In the proof of concept (POC), injected scripts return local file content, which would allow arbitrary local file reads from the app's runtime context. These local files contain device and user data within the ePCR medical application, and if exposed, would allow an attacker to access protected health information (PHI) or device telemetry.

The weakness was disclosed by Bryan Riggins as icsma-26-041-01. It is possible to read the advisory at cisa.gov. The identification of this vulnerability is CVE-2025-12699 since 11/04/2025. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1083 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Medical Device Software

Vendor

• ZOLL

Name

• ePCR IOS Mobile Application

Version

• 2.6.7

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion