Security readout for executives and security teams
Plain-English summary
CVE-2020-27374 describes a replay-attack issue affecting Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1. In plain terms, previously captured blood-pressure monitoring communications may be reusable, potentially affecting trust in readings or device interactions. Public data is sparse, with no CVSS score, no vendor advisory, and no confirmed active exploitation in the provided sources.
Executive priority
Treat as a targeted device-trust issue, not an enterprise-wide emergency based on current evidence. Priority is moderate for healthcare, clinical, or wellness programs relying on this device’s readings, and lower where the product is not deployed. The main business concern is integrity of monitoring data and user trust.
Technical view
The CVE record states that Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to a replay attack to BP monitoring. The record does not provide protocol details, prerequisites, attack range, CVSS metrics, CWE mapping, fixed versions, or formal affected CPEs. The Medium reference appears to be the primary technical write-up, but the supplied bundle contains only its URL.
Likely exposure
Exposure appears limited to environments using the named Dr Trust iCheck Connect BP monitor/app version. The public CVE metadata does not identify broader affected models, firmware versions, mobile platforms, or deployment conditions. Organizations should treat exposure as unconfirmed until asset owners verify whether this exact product and version are in use.
Exploitation context
No CISA KEV listing is present, and the supplied sources do not state active exploitation. The described weakness is a replay attack, which generally requires access to relevant communications or interaction context. The available public metadata does not specify attacker proximity, required equipment, authentication state, or impact severity.
Researcher notes
The public record is unusually thin: no CVSS, no CWE, no CPEs, no fixed version, and minimal affected-product structure. Further assessment should rely on the CVE record, the referenced researcher write-up, and any vendor response. Do not assume other Dr Trust products are affected without evidence.
Mitigation direction
- Identify whether Dr Trust iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is in use.
- Check Dr Trust support channels for updated firmware, app versions, or security guidance.
- Avoid using affected devices for high-trust clinical decisions until vendor guidance is confirmed.
- Limit untrusted access near device communications where feasible.
Validation and detection
- Inventory connected blood-pressure monitors and associated mobile applications.
- Confirm exact model, app, and firmware versions against the CVE description.
- Review vendor documentation for any security update or configuration guidance.
- Document whether compensating controls are needed for medical or wellness workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-27374 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitorCVE reference, mitre
- https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5cCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.