Which versions of Apollo Blood Glucose Monitor are affected by CVE-2026-50034?

The Apollo Pharmacy Blood Glucose Monitoring System (Model APG-01 BT) transmits patient glucose readings and health data in cleartext over Bluetooth, enabling attackers within radio range to…

How to fix or mitigate CVE-2026-50034?

Within 24 hours: Conduct inventory of all APG-01 BT devices in clinical use and identify affected patient populations; escalate to compliance and risk management. Within 7 days: Issue usage guidance restricting deployment to isolated environments where feasible; formally notify vendor Apollo Pharmacy requesting remediation timeline and requesting accelerated patch delivery. Within 30 days: Evaluate transition to encrypted blood glucose monitoring alternatives and establish discontinuation timeline if patch remains unavailable beyond 60 days.

Apollo Blood Glucose Monitor CVE-2026-50034

Q: What is the CVSS score of CVE-2026-50034?

CVE-2026-50034 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-37971 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-06-18 icscert

GHSA-cmv8-9pgg-5rx4

Information Disclosure Blood Glucose Monitoring System Model No Apg 01 Bt

7.1

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Adjacent BLE radio attack with no privileges or interaction; passive sniffing of unencrypted health data yields high confidentiality impact only, no integrity or availability effect.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 00:32 vuln.today

Severity Changed

Jun 19, 2026 - 00:22 NVD

MEDIUM HIGH

CVSS changed

Jun 19, 2026 - 00:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

DescriptionCVE.org

An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measurement values.

AnalysisAI

Cleartext Bluetooth Low Energy transmission in the Apollo Pharmacy Blood Glucose Monitoring System (Model APG-01 BT) allows an attacker within BLE radio range to passively sniff wireless traffic and recover patient glucose readings and related health data. The flaw is a CWE-319 cleartext-transmission issue affecting a consumer medical device, disclosed via CISA ICS-CERT advisory ICSMA-26-169-01. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected product is a consumer blood glucose meter that pairs with a companion mobile application over Bluetooth Low Energy (BLE) to deliver measurement readings. CWE-319 (Cleartext Transmission of Sensitive Information) indicates the BLE link layer is used without applying pairing/bonding-based encryption (LE Secure Connections or legacy LE encryption) or any application-layer encryption over GATT characteristics, so glucose measurement values are emitted in plaintext on the BLE radio interface. The single affected CPE is cpe:2.3:a:apollo_pharmacy:blood_glucose_monitoring_system_(model_no._apg-01_bt) (all versions), and CISA's referenced 'Understanding Bluetooth Technology' guidance underscores that confidentiality on BLE requires explicit pairing-time encryption, which this product does not enforce.

RemediationAI

No vendor-released patch identified at time of analysis; consult CISA ICSMA-26-169-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-169-01) and contact Apollo Pharmacy via https://www.apollopharmacy.in/contact-us for firmware status. As compensating controls, users and care providers should operate the meter in environments where casual BLE eavesdroppers are unlikely (e.g., avoid taking readings in public spaces, clinics, or shared housing) accepting the trade-off of reduced convenience, disable BLE on the meter between readings to shrink the exposure window at the cost of having to re-pair, and where clinically acceptable read values directly from the device display rather than syncing to the phone app. Organizations procuring the device for patient programs should review CISA's Bluetooth guidance (https://www.cisa.gov/news-events/news/understanding-bluetooth-technology) and consider substituting with meters that enforce BLE LE Secure Connections pairing until a fix is published.