Which versions of Apollo APG-01 BT are affected by CVE-2026-52866?

The Apollo Pharmacy Blood Glucose Monitoring System (APG-01 BT) contains a denial-of-service vulnerability that allows attackers within Bluetooth range to block legitimate patient and clinician…

How to fix or mitigate CVE-2026-52866?

Within 24 hours: Inventory all APG-01 BT units deployed in clinical environments and notify clinical leadership and patient safety teams of the vulnerability. Within 7 days: Implement compensating controls including Bluetooth range isolation or physical RF shielding at high-risk locations; begin communication with Apollo Pharmacy regarding patch timeline and alternative device options. Within 30 days: Deploy unauthorized BLE device detection monitoring; establish redundant manual glucose verification protocols; complete risk assessment for all patient-dependent workflows relying on APG-01 BT; document business continuity procedures if device unavailability occurs.

Apollo APG-01 BT CVE-2026-52866

Q: What is the CVSS score of CVE-2026-52866?

CVE-2026-52866 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37970 HIGH

Missing Authorization (CWE-862)

2026-06-18 icscert

GHSA-47r7-422p-6w2p

Authentication Bypass Blood Glucose Monitoring System Model No Apg 01 Bt

7.1

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Adjacent BLE radio range gives AV:A; no auth, complexity, or user interaction needed; only availability of the single BLE slot is impacted, so C:N/I:N/A:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 00:31 vuln.today

Severity Changed

Jun 19, 2026 - 00:22 NVD

MEDIUM HIGH

CVSS changed

Jun 19, 2026 - 00:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

DescriptionCVE.org

An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from establishing a connection.

AnalysisAI

Denial-of-service in the Apollo Pharmacy Blood Glucose Monitoring System (model APG-01 BT) allows an attacker within Bluetooth Low Energy radio range to seize the device's single BLE connection slot, blocking the legitimate patient app or clinician from pairing and reading glucose measurements. The flaw is rooted in missing authorization (CWE-862) on connection acceptance and was disclosed through CISA's ICS Medical advisory ICSMA-26-169-01. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected device is a consumer/medical Bluetooth Low Energy peripheral that, like most low-power BLE sensors, supports only a single concurrent GATT connection. CWE-862 (Missing Authorization) applies because the device accepts and holds any incoming BLE connection without verifying that the peer is a paired/authorized companion app, so the connection slot itself becomes the controlled resource. Because BLE peripherals typically advertise continuously while unpaired and have no out-of-band signalling to evict a squatting central, any reachable attacker can occupy the slot until they choose to disconnect - a classic resource-exhaustion pattern against single-link IoT/medical sensors. The CPE identifies the exact product: cpe:2.3:a:apollo_pharmacy:blood_glucose_monitoring_system_(model_no._apg-01_bt).

RemediationAI

No vendor-released patch identified at time of analysis from the provided references; the ICSMA-26-169-01 advisory (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-169-01) should be consulted for any firmware update or mitigation guidance issued after publication, and end users should reach Apollo Pharmacy support (https://www.apollopharmacy.in/contact-us) for device-specific updates. As compensating controls, operate the meter only in physically controlled environments and power it off between readings so its BLE radio is not continuously advertising, pair the meter with the companion app immediately before taking a measurement to minimize the squatting window, and treat repeated unexplained connection failures as a possible interference or attack indicator rather than a battery issue. These workarounds reduce exposure but do not eliminate the flaw and add friction to normal patient use, which is an explicit trade-off until a firmware fix is released.