Which versions of Mira Hormone Monitor are affected by CVE-2026-66098?

Mira hormone monitoring devices contain an unauthenticated vulnerability (CVE-2026-66098, CVSS 7.1) enabling attackers within Bluetooth range to remotely force affected devices into bootloader mode…

How to fix or mitigate CVE-2026-66098?

Within 24 hours, inventory all Mira devices in clinical use and document physical deployment locations and associated patient monitoring workflows to quantify operational risk. Within 7 days, implement interim controls including restricting physical access to areas where devices operate, configuring Bluetooth scanning to detect suspicious characteristic write attempts, and establishing procedures to identify and restart devices that unexpectedly enter bootloader states. Within 30 days, establish direct communication with vendor to confirm patch timeline, prepare a staged firmware update plan for production deployment, and evaluate alternative monitoring solutions if patch availability extends beyond 90 days.

Mira Hormone Monitor CVE-2026-66098

Q: What is the CVSS score of CVE-2026-66098?

CVE-2026-66098 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-57007 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-11 ics-cert@hq.dhs.gov

GHSA-5pc2-vj8c-ggcr

Authentication Bypass

7.1

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Adjacent BLE vector (AV:A), no authentication required (PR:N), no confidentiality or integrity impact, high availability loss from forced reboot into bootloader mode with no scope change.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:40 vuln.today

CVE Published

Aug 11, 2026 - 22:18 cve.org

HIGH 7.1

DescriptionCVE.org

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow.

AnalysisAI

Mira hormone monitor device firmware exposes an unauthenticated BLE characteristic write path that forces the device into bootloader mode when any adjacent BLE central sends a 0x01 value, with no credential verification required. Disclosed via CISA ICS Medical Advisory ICSMA-26-223-01, the vulnerability maps to CWE-306 (Missing Authentication for Critical Function) and carries a CVSS 4.0 score of 7.1 with high availability impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only commodity BLE hardware and physical proximity.

Technical ContextAI

The Mira device is a consumer-grade medical IoT wearable for hormone and fertility monitoring that communicates over Bluetooth Low Energy (BLE). The firmware exposes a BLE characteristic that, upon receiving a write of value 0x01 from any connected BLE central, triggers a reboot into bootloader (DFU) mode - a privileged device management function. The root cause is CWE-306: Missing Authentication for Critical Function. Bootloader-mode entry is a sensitive operation that should require mutual authentication or a pairing-bound authorization check; the firmware performs neither. No CPE strings were included in the source data, so the exact affected firmware version range must be confirmed via the CISA CSAF advisory. The adjacent attack vector (AV:A) reflects BLE's physical range constraint of approximately 10-30 meters under typical conditions.

RemediationAI

The primary fix requires a vendor-released firmware update that enforces authentication - such as BLE pairing verification or a session token check - before processing writes to the bootloader-trigger characteristic. No specific patched firmware version has been confirmed from the available data; consult CISA advisory ICSMA-26-223-01 at https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01 for vendor guidance and patch availability. As a compensating control, users should disable Bluetooth on the Mira device when not actively syncing with the companion application, eliminating the BLE attack surface entirely during idle periods; the trade-off is that passive background monitoring that relies on a live BLE connection may be interrupted. Avoiding use of the device in crowded public spaces during active monitoring sessions reduces opportunistic exploitation risk. Apply the vendor firmware update as soon as it is confirmed available.