EUVD-2026-97894
GHSA-hj6p-cc45-4m6g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition within Bluetooth range of victim
-
ExploitConnect to watch as unpaired BLE client
-
ExecutionSubscribe to Heart Rate characteristic 0x2A37
-
ImpactReceive live heart-rate telemetry
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be within Bluetooth (BLE) radio range of the target while the BSW013 watch is powered on and advertising, running firmware through V0.0.8, and to subscribe to the Heart Rate Measurement GATT characteristic (0x2A37). No pairing, bonding, authentication, or on-watch user confirmation is needed (PR:N/UI:N). Limiting factors: the attacker must maintain physical proximity to a present victim (AV:A, AT:P), the only data obtainable is live heart-rate readings (confidentiality-only, no control of the device), and exposure ends when the watch leaves range or is powered off. |
| Impact | This is a genuinely low-priority issue despite being a real authentication flaw. The provided CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) yields a base score of 2.3 (Low), which is consistent with the narrow impact: confidentiality-only (VC:L), no integrity or availability effect, and an adjacent/proximity attack vector (AV:A, Bluetooth range) gated by an attack requirement (AT:P) that the victim and their watch be present and within range. The CWE-306 (missing authentication) classification matches the description precisely - unpaired BLE devices can subscribe to the Heart Rate Measurement characteristic. No EPSS score was supplied and the CVE is not on CISA KEV, so there is no signal of widespread or active exploitation; the only exploitation signal is a referenced GitHub repository (Pratham-16/fireboltt-Bsw013-BLE-vuln) that appears to contain proof-of-concept/research code. Signals are internally consistent - there is no network-vs-local contradiction here; the only exposure is a single data characteristic (heart rate) readable at close range. The realistic risk is a privacy leak against a specific individual an attacker is already physically near, not a scalable or impactful compromise. This is a legitimately low-risk, low-CVSS finding, not a high-CVSS flaw masquerading as low. |
| Exploit ScenarioDerived | An attacker within Bluetooth range (a few meters) of a person wearing a Fire-Boltt BSW013 watch uses a generic BLE client to connect and subscribe to the Heart Rate Measurement characteristic (0x2A37), receiving live heart-rate readings with no pairing, bonding, or on-watch confirmation. A referenced GitHub repository appears to provide proof-of-concept code demonstrating the subscription. The AV:A/AT:P vector means the attacker must stay in physical proximity to a present, powered-on target, limiting this to close-range, targeted privacy surveillance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Live heart-rate readings can be intercepted over Bluetooth Low Energy from Fire-Boltt BSW013 smartwatches running firmware through V0.0.8, because the Heart Rate Measurement characteristic (0x2A37) accepts subscriptions from unpaired devices with no bonding, authentication, or on-watch confirmation. An attacker within BLE radio range of a powered-on, advertising watch can collect the wearer's heart rate in real time without authenticating or interacting with the victim, and the vector (PR:N/UI:N) confirms no credentials or user action are required, though the exposure is confidentiality-only and ends when the watch leaves range or is powered off. Risk is genuinely low (CVSS 4.0 base 2.3; independent assessment 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; no vendor-released patch was identified in the provided data.
RemediationAI
No vendor-released patch was identified at time of analysis, so the durable fix is a Fire-Boltt firmware update that enforces LE Secure Connections or authenticated (encrypted) access to the Heart Rate Measurement characteristic before it will emit notifications; users should watch the Fire-Boltt support channels and the disclosure references (https://github.com/Pratham-16/fireboltt-Bsw013-BLE-vuln and https://www.vulncheck.com/advisories/fire-boltt-bsw013-firmware-through-v0-0.8-unauthenticated-heart-rate-disclosure-via-ble) and apply the first firmware release above V0.0.8. Until such a release exists, compensating controls are necessarily physical and procedural: power the watch off in locations where untrusted parties could sit within roughly 10 metres of the wearer (trade-off: the watch is unusable during those periods), or leave it outside secure rooms and meetings where BLE proximity is plausible; there is no user-facing setting that disables only the heart-rate characteristic, so partial mitigation is not available. Organisations concerned about wearable telemetry can prohibit powered-on BLE wearables in sensitive areas or use BLE scanning/jamming controls (trade-off: scanning detects but does not prevent subscription, and jamming is illegal in most jurisdictions and disrupts all 2.4 GHz devices). Given the confidentiality-only, proximity-bound nature of the issue, prioritise it below memory-corruption and remote-code-execution findings while tracking vendor firmware announcements for a definitive fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a textbook CWE-306 (Missing Authentication for Critical Function) instance in the Bluetooth Low Energy GATT layer. The BSW013 exposes the standard Heart Rate Service (0x180D) and its Heart Rate Measurement characteristic (0x2A37), which by design supports notifications so a bonded peer - typically a phone app or gym equipment - can stream beat-to-beat values. The firmware through V0.0.8 permits any BLE central to discover the characteristic and subscribe to notifications without first establishing a bonded/encrypted link or enforcing authenticated ATT permissions, so the characteristic's read/notify access is effectively open to anyone in radio range. No CPE identifiers were supplied in the source data, so affected-asset identification must rely on vendor and model naming (Fire-Boltt, model BSW013) and on firmware version reporting in the companion app. The CVSS 4.0 vector's AT:P/AV:A components reflect the operational reality of this class: the watch must be powered on and advertising, and the attacker must be physically proximate, which keeps the practical attack surface small and the impact limited to observation of a single data stream rather than any write, control, or lateral movement capability.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Adjacent BLE vector (AV:A) with no auth or interaction (PR:N/UI:N); only low-sensitivity heart-rate data is disclosed, so C:L and I:A none.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB