Mira Care CVE-2026-64934

Q: What is the CVSS score of CVE-2026-64934?

CVE-2026-64934 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-56980 MEDIUM

Reliance on Untrusted Inputs in a Security Decision (CWE-807)

2026-08-11 icscert

GHSA-v72c-jrwc-x8qx

Information Disclosure Mira Firmware Mira Android App Quanovate Tech Inc Operating As Mira Mira Care

5.3

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible cloud API requires authenticated session (PR:L); integrity impact added for falsification of vendor fleet version records, absent from the source CVSS 4.0 assessment.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:55 vuln.today

CVE Published

Aug 11, 2026 - 21:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.

AnalysisAI

Firmware version spoofing in the Mira cloud API allows authenticated users to submit arbitrary firmware version strings for their own registered devices, bypassing server-side validation entirely. Affected products are Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 by Quanovate Tech Inc., operating in a medical IoT context and reported under CISA ICS-CERT advisory ICSMA-26-223-01. An attacker exploiting this flaw can cause the vendor backend to misrecord their device's patch state, suppressing security update prompts and distorting fleet-wide vulnerability analytics - with no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-807 (Reliance on Untrusted Inputs in a Security Decision): the Mira cloud API delegates firmware version authority to the companion Android app rather than attesting the version through a device-originated, cryptographically verifiable mechanism. The two affected components - Mira Firmware (CPE: cpe:2.3:a:quanovate_tech_inc._(operating_as_mira_/_mira_care):mira_firmware:*:*:*:*:*:*:*:*) and Mira Android App (CPE: cpe:2.3:a:quanovate_tech_inc._(operating_as_mira_/_mira_care):mira_android_app:*:*:*:*:*:*:*:*) - form a cloud-connected medical IoT ecosystem. The design flaw is architectural: without device-attestation (e.g., TPM-backed signing, secure enclave assertion, or backend-to-device direct version polling), the cloud cannot distinguish a legitimate firmware version report from a spoofed one injected by the authenticated app session.

RemediationAI

No specific patched version number is independently confirmed from the available intelligence; the CISA ICS-CERT advisory ICSMA-26-223-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01) is the authoritative source for vendor-issued remediation guidance and should be consulted directly for upgrade paths. The architectural fix requires Quanovate Tech to implement server-authoritative firmware version attestation - polling the device directly or validating a cryptographically signed version assertion from the device rather than trusting the companion app. As compensating controls pending a patch: healthcare operators should monitor Mira cloud API logs for anomalous or repeated firmware version string submissions that deviate from known release identifiers; restrict Mira account access using strong authentication (MFA) to reduce the pool of authenticated attackers; and establish out-of-band patch compliance verification (e.g., physical inspection or separate telemetry channel) to avoid sole reliance on cloud-reported firmware state for fleet management decisions. Note that MFA does not eliminate the vulnerability but raises the bar for unauthorized account access.