Ossur Mobile Logic Application Exposure of Sensitive System Information to an Unauthorized Control Sphere

published 2025-01-17 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-52028

cvss: 4.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits: 0; none known

A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA. An attacker could use the information to disrupt normal use of the application by changing the translation files and thus weaken the integrity of normal use.

Patch / fix

fixed in 1

Ossur Mobile Logic Application 1.5.5

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-24-354-01 updated 2024-12-19 cvss 4.4

Ossur Mobile Logic Application

Ossur Logic Mobile Application <1.5.5
affected: mitigation

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 21 mo ago (2025-01-21)

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CNA	4.0	5.6	CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA	4.0	5.6	CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Ossur Mobile Logic Application

Classification

Weakness

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

References

cisa.gov /news-events/ics-medical-advisories/icsma-24-354-01

Sources

CVE List CVE-2024-53683
NVD CVE-2024-53683

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary