CVE-2025-12699: ZOLL ePCR IOS XSS Vulnerability

CVE-2025-12699 Overview

CVE-2025-12699 is a Cross-Site Scripting (XSS) vulnerability affecting the ZOLL ePCR iOS application used in emergency medical services. The application fails to sanitize user input before reflecting it into a WebView component. When attacker-controlled strings are placed into Patient Care Report (PCR) fields—including run number, incident, call sign, and notes—the content is interpreted as HTML/JavaScript during print or render operations. This vulnerability enables arbitrary local file reads from the application's runtime context, potentially exposing protected health information (PHI) and device telemetry data.

Critical Impact
Successful exploitation could allow attackers to access sensitive medical records, protected health information (PHI), and device telemetry data through arbitrary local file reads within the ePCR application context.

Affected Products

ZOLL ePCR iOS Application

Discovery Timeline

2026-02-10 - CVE CVE-2025-12699 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2025-12699

Vulnerability Analysis

This vulnerability stems from improper input validation in the ZOLL ePCR iOS application's WebView implementation. The application is designed to manage electronic Patient Care Reports (ePCR) for emergency medical services, handling sensitive medical data during patient transport and treatment documentation.

The core issue lies in how the application processes and renders user-supplied content within its WebView component. When medical personnel enter data into PCR fields (run number, incident details, call sign, and notes), this input is stored and later rendered without proper sanitization. The WebView interprets any HTML or JavaScript embedded within these fields as executable code rather than treating it as plain text data.

According to proof-of-concept research documented in the CISA Medical Advisory, injected scripts can successfully exfiltrate local file content from the application's sandboxed environment. This represents a significant security concern given the healthcare context and the regulatory requirements around PHI protection under HIPAA.

Root Cause

The vulnerability is classified under CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory), indicating that the application fails to properly isolate sensitive local files from web content execution contexts. The root cause is the absence of input sanitization and output encoding when user-supplied PCR field data is rendered within the iOS WebView. The application trusts input data without validating or escaping HTML/JavaScript special characters, creating a reflected XSS condition.

Attack Vector

The attack requires local access to the device running the ZOLL ePCR application. An attacker would need to:

Gain access to the ePCR application interface (either through physical device access or social engineering)
Enter malicious HTML/JavaScript payloads into vulnerable PCR input fields such as run number, incident details, call sign, or notes
Trigger the print or render functionality within the application
The malicious script executes within the WebView context, enabling file system access
Exfiltrate local files containing PHI, device identifiers, or other sensitive telemetry

The attack does not require special privileges but does require user interaction to trigger the vulnerable rendering functionality. The proof-of-concept demonstrates that injected scripts can successfully return local file content, providing read access to sensitive application data.

Detection Methods for CVE-2025-12699

Indicators of Compromise

Unusual or malformed entries in PCR fields containing HTML tags, script elements, or JavaScript code patterns
Unexpected file access requests originating from the ePCR application process
Network traffic anomalies suggesting data exfiltration from the application sandbox
Log entries showing rendering errors or JavaScript execution warnings within the application

Detection Strategies

Implement Mobile Device Management (MDM) solutions to monitor application behavior and detect anomalous file access patterns
Deploy endpoint detection and response (EDR) solutions capable of monitoring iOS application activity
Review application logs for evidence of script injection attempts in PCR field entries
Monitor for unauthorized data transmission from devices running the ePCR application

Monitoring Recommendations

Establish baseline behavior patterns for the ZOLL ePCR application and alert on deviations
Configure network monitoring to detect unusual outbound connections from medical devices
Implement audit logging for all PHI access within the application environment
Regularly review PCR entries for suspicious content patterns that may indicate injection attempts

How to Mitigate CVE-2025-12699

Immediate Actions Required

Contact ZOLL Data through ZOLL Data Contact Information to obtain information about available patches or updates
Restrict physical access to devices running the vulnerable ePCR application
Implement network segmentation for devices used in medical record management
Train staff to recognize and report suspicious entries in PCR fields

Patch Information

Organizations should consult the CISA Medical Advisory ICSMA-26-041-01 for official remediation guidance. Additional technical details are available in the GitHub CSAF Document. Contact ZOLL directly for patch availability and update instructions specific to your deployment.

Workarounds

Implement administrative controls to limit who can enter data into PCR fields pending patch availability
Use device management policies to restrict network access for vulnerable devices
Enable additional logging and monitoring for the ePCR application environment
Consider temporarily disabling print/render functionality if operationally feasible until a patch is applied