EUVD-2026-42155
GHSA-wjqj-v3q8-x4h3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
BLE proximity makes it AV:A not AV:N; requiring prior packet capture under specific conditions is AC:H; replaying writes is a limited integrity impact (I:L) with no confidentiality or availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.
AnalysisAI
Improper authentication in Fire-Boltt FB BGS001 smartwatch firmware MOY-JS14-2.0.4 lets a nearby attacker replay previously captured Bluetooth Low Energy (BLE) GATT Write Request packets to trigger device functionality without valid session validation. The device accepts write commands over BLE without sufficient authentication, so an attacker within radio range who has observed legitimate traffic can reissue those commands. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires BLE radio proximity to the target Fire-Boltt FB BGS001 (firmware MOY-JS14-2.0.4) and prior capture of legitimate GATT Write Request packets from that device - the description explicitly states 'previously captured BLE packets can be replayed from a nearby device' and 'under specific conditions.' Limiting factors: the attacker must be physically nearby (not remote/internet-reachable despite the AV:N in the published vector), must have observed valid traffic to replay (so the watch must be in active use within sniffing range), and impact is bounded to whatever functionality those replayable write commands control rather than arbitrary code execution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and the published CVSS 3.1 (9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sits within BLE range of a victim and passively sniffs the smartwatch's radio traffic while the user issues a normal command from the paired phone. Having captured the GATT Write Request packets, the attacker later returns within range and replays them from their own device to re-trigger that functionality on the watch. … |
| Remediation | No vendor-released patch version is identified at time of analysis; the referenced material (CDAC Hyderabad GitHub repo and PDF at https://github.com/EmbdCDACHyd/CVE/tree/main/CVE-2026-37271) is a research disclosure, not a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify and inventory all Fire-Boltt FB BGS001 devices in use across the organization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today