United States
MedTech Diagnostics
A security assessment across the web application, API, and AWS environment, focused on protecting diagnostic data, strengthening access controls, and supporting the client’s FDA compliance requirements.
United States
MedTech Diagnostics
Infectious Disease
Rapid Diagnostic Solutions
Web + API + AWS
Connected Platform
FDA Compliance
Submission Preparation
The client needed an assessment capable of meeting regulatory expectations while giving its engineering team clear direction across the connected application environment.
A manual, human-led approach was used to examine authentication and data-handling controls beyond automated scanning.
The assessment was structured around the client's FDA compliance requirements.
The engagement supported the full web, API, and cloud scope without requiring the client to narrow the assessment.
The process remained organized and transparent across all three technology layers, from scoping through delivery.
Qualysec brought the web application, API, and AWS environment into one coordinated review, giving the client a clear path from technical assessment to regulatory preparation.
Peer-verified
Trusted worldwide
A flaw in the password reset flow allowed an attacker to hijack the process and gain control of another user's account without needing their original credentials. On a platform handling diagnostic results, this gives an attacker direct access to another user's test data and account history.
Potential impact: Unauthorized access to user accounts and diagnostic test history.
An attacker could inject a malicious script that gets saved on the server and executed whenever another user, potentially a clinician reviewing diagnostic results, loads the affected page. That gives an attacker a route into another user's session without needing login credentials.
Potential impact: Session hijacking via injected scripts executed by other users.
A standard user could elevate their own access to a higher permission level by exploiting flaws in how the application enforced role checks, potentially reaching administrative functions or diagnostic data reserved for higher-privileged accounts.
Potential impact: Unauthorized access to administrative functions and restricted diagnostic data.
Certain API endpoints allowed a request to pull diagnostic data belonging to another account simply by changing an identifier, without a server-side check confirming ownership.
Potential impact: Unauthorized access to diagnostic data belonging to other accounts.
Storage configurations in the AWS environment granted broader access than necessary, leaving diagnostic data reachable by more of the system than the client had intended.
Potential impact: Unintended internal system exposure of sensitive diagnostic data.
Weaknesses across authentication, authorization, and cloud access could have created opportunities for unauthorized access to patient diagnostic information and increased security concerns during the FDA compliance review.
Qualysec worked alongside the client's engineering team across the application, API, and cloud environment, providing remediation guidance and documentation aligned with the client's FDA compliance requirement.
The password reset workflow was rebuilt to strengthen account recovery and verification.
Input handling was improved to prevent malicious content from being stored and executed through the application.
Role-based permissions and API ownership checks were tightened to restrict access to authorized users.
AWS storage permissions were reviewed and restricted to remove unnecessary access to diagnostic information.
The web application, API, and AWS environment were retested, with the completed work documented to support the FDA compliance submission.
Secure Account Recovery
Authentication workflows were reinforced around password recovery.
Controlled Diagnostic Data Access
Application and API authorization controls were strengthened.
Restricted Cloud Storage
AWS permissions were tightened around sensitive diagnostic information.
FDA Compliance Support
Security documentation was prepared to support the regulatory review process.
If you need a penetration test, let’s have a talk. Fill out this form and we will ensure you are secured and hit full compliance without any hurdles. The immediate impact you can expect:
Our sales team will reach out instantly
We skip the back-and-forth to meet your deadline perfectly
We get your testing scheduled immediately without any delay
Total No. Of Vulnerabilities
Years in Business
Assessment Completed
Trusted Clients
Countries Served