Fire-Boltt BSW013 CVE-2026-109570

Exploitation requires the attacker to be within Bluetooth Low Energy radio range of the target BSW013 watch (AV:A - physical proximity, typically a few meters, not remote/internet-based). No pairing, authentication, or user interaction is needed (PR:N/UI:N), and the only integrity protection on the proprietary command characteristic is a CRC-16/ARC checksum, which is an error-detection code with no cryptographic security and is trivially recomputed by an attacker. Limiting factors: the attack targets one device at a time, requires physical proximity (cannot be conducted at scale or over the internet), and impact is confined to spoofed notification display and vibration (phishing/social-engineering) - it cannot read device data or cause denial of service.

This is a genuine but low-severity, narrow-impact issue rather than a high-priority emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms the attack is adjacent (Bluetooth range only - NOT network-reachable), low-complexity, and requires no authentication or user interaction, consistent with the CWE-306 missing-authentication root cause and the 'unpaired attackers' language in the description. However, impact is deliberately scoped low: only VI:L (integrity) is set, with confidentiality (VC:N) and availability (VA:N) untouched - the attacker can spoof notification text and vibrate the watch, but cannot read data or disrupt the device, which is why the score lands at 5.3 (Medium). No EPSS score, SSVC decision, or KEV status was supplied in the input, so automatability and exploitation-in-the-wild signals cannot be evaluated. A public research/exploit repository is referenced (github.com/Pratham-16/fireboltt-Bsw013-BLE-vuln), indicating exploit code likely exists, but this is POC availability and must not be conflated with active exploitation. Net: the adjacency requirement (physical Bluetooth proximity, one target at a time) and phishing-only impact cap real-world risk far below what the 'unauthenticated/no-UI' metrics might suggest in isolation.

An attacker within Bluetooth range of a victim's Fire-Boltt BSW013 watch (e.g., in a cafe, transit, or office) writes a crafted command to the proprietary BLE command characteristic without pairing, protected only by a trivially-computable CRC-16/ARC checksum. The watch vibrates and displays attacker-chosen alert text - for example a fake bank or delivery notification - to socially engineer the victim into a phishing action. Public research/exploit code appears to exist in the referenced GitHub repository, lowering the effort to reproduce.