## 4 Results and Comparative Analysis
### Cross-Domain Risk Propagation  
While single vulnerabilities have localized effects, it is when the vulnerabilities are successfully exploited against interconnected sequences that they will have their greatest manifestations; thus, this is particularly problematic in multi-layer systems such as PHGL-COVID. In this section, realistic scenarios of cross-domain propagation will be discussed, wherein an attacker could use a single vulnerability in one layer (e.g., wearable) to exploit a higher-privileged layer (e.g., backend API). To better illustrate the multi-step exploitation model observed in the PHGL-COVID platform, Figure 3 presents a flowchart outlining how vulnerabilities identified at the wearable layer (e.g., BLE data leaks) can propagate through the mobile intermediary and \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Layer** & **Key Attack Vectors** & **Likelihood** & **Impact** & **Exploitability** & \begin{tabular}{c} **Recommended** \\ **Mitigations** \\ \end{tabular} \\ \hline \multirow{3}{*}{Server} & \begin{tabular}{c} Unpatched CVEs \\ (zlib, SQLite, \\ libexpat), exposed \\ ports \\ \end{tabular} & High & Critical & \begin{tabular}{c} Moderate- \\ High \\ \end{tabular} & \begin{tabular}{c} Regular image scanning \\ (Triyy), base image \\ hardening \\ \end{tabular} \\ \hline \multirow{3}{*}{Mobile (A55)} & \begin{tabular}{c} Legacy services \\ (UPnP, Zeus Admin) \\ \end{tabular} & Medium & High & Moderate & \begin{tabular}{c} Port minimization, \\ firewall, TLS \\ enforcement \\ \end{tabular} \\ \hline \multirow{3}{*}{Mobile (A55)} & \begin{tabular}{c} Token persistence, \\ overprivileged system \\ apps \\ \end{tabular} & High & High & High & \begin{tabular}{c} Remove unused apps, \\ enforce SELinux, audit \\ permissions \\ \end{tabular} \\ \hline \multirow{3}{*}{Wearable (GW7)} & \begin{tabular}{c} Non-EU firmware, \\ permissive SELinux \\ \end{tabular} & Medium & Moderate & Moderate & \begin{tabular}{c} Flash verified firmware, \\ enforce runtime policies \\ \end{tabular} \\ \hline \multirow{3}{*}{Wearable (GW7)} & \
\begin{tabular}{c} BLE GATT readouts, \\ advertising active, no \\ auth on BLE \\ \end{tabular} & High & Moderate & High &
\begin{tabular}{c} Secure pairing, GATT \\ access control, disable \\ BLE adv \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Cross-Layer Risk Comparison in the PHGL-COVID Platform. culminate in attacks on the backend server. Each stage highlights trust violations and attack vectors that enable chained abuse across the platform. This flowchart visualizes a realistic sequence of compromise that begins at the lowest-privilege device and escalates through implicit trust links. It emphasizes how independent medium-severity vulnerabilities, if aligned across layers, can form a critical attack path capable of compromising sensitive health infrastructure. Such scenarios reinforce the need for integrated telemetry, privilege control, and attack surface minimization at all layers. One propagation scenario begins with the Galaxy Watch 7 device, which broadcasts unverified and unencrypted biometric data, not requiring an authentication layer, over its BLE services. An attacker close by can use passive sniffing methods, or they could even spoof GATT notification packets to the Samsung Galaxy A55 device--despite BLE handling, and overprivileged background apps that are secure and verified--the mobile device accepts and processes the data entirely without integrity checks. If the mobile client sends this data to the backend API, the attacker has successfully staged the exploitation again, meaning that he could trigger an injection-based anomaly in the server layer, or bypass the intended service logic on the server [46; 55; 56]. A second vector is based on user tokens exposed to the mobile layer. As a note, access tokens are observed to persist, in plaintext, even after a session has expired.