What’s Vulnerable › Vulnerabilities

CVE-2022-41627

• Severity: high (CVSS 7.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-27 · updated 2026-06-17
• Weakness: CWE-311

Description

The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocols. Exploiting this vulnerability could allow an attacker to read patient EKG results or create a denial-of-service condition by emitting sounds at similar frequencies as the device, disrupting the smartphone microphone’s ability to accurately read the data. To carry out this attack, the attacker must be close (less than 5 feet) to pick up and emit sound waves.

Affected products

• AliveCor Kardiamobile 6L Firmware: all versions
• AliveCor Kardiamobile Card Firmware: all versions
• AliveCor Kardiamobile Firmware: all versions

References

• https://www.cisa.gov/uscert/ics/advisories/icsma-22-298-01
• https://www.cisa.gov/uscert/ics/advisories/icsma-22-298-01

Get alerted when CVE-2022-41627 or the next vulnerability affects your stack