EUVD-2026-57009
GHSA-hqrj-p65x-4mf9
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A reflects BLE proximity requirement; PR:N because no authentication exists; S:U because impact is confined to the device itself with no downstream system compromise indicated.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
2DescriptionCVE.org
In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10-30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates.
AnalysisAI
Unauthenticated BLE command execution in Mira hormone monitor firmware v1.7.1.47 build 01070147 allows any attacker within Bluetooth range (10-30 meters) to silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, and trigger denial-of-service via undocumented opcodes - all without credentials or user interaction. The device's static, non-rotating BLE address additionally enables persistent passive tracking of the user across physical encounters. Reported via CISA ICS Medical Advisory ICSMA-26-223-01; no public exploit code or CISA KEV listing identified at time of analysis.
Technical ContextAI
The Mira hormone monitor is a consumer medical wearable that communicates with a companion application over Bluetooth Low Energy (BLE). The firmware version v1.7.1.47 build 01070147 fails to enforce authentication for critical BLE-exposed functions, mapping to CWE-306 (Missing Authentication for Critical Function). Specific deficiencies include: (1) no authentication gate on the account-binding command, allowing device ownership takeover; (2) hormone measurement data retrievable in cleartext over the BLE interface with no encryption or access control; (3) undocumented or malformed command opcodes accepted without sanitization, enabling DoS; and (4) use of a static random BLE address that never rotates, violating BLE privacy best practices and enabling persistent physical tracking. The CVSS 4.0 vector AV:A reflects the adjacent-network constraint imposed by BLE's physical propagation characteristics.
RemediationAI
The primary remediation is a vendor-issued firmware update that implements BLE authentication for all critical device functions and enables BLE address rotation per Bluetooth Core Specification privacy recommendations. No specific patched firmware version is confirmed in the available input data - consult CISA ICS Medical Advisory ICSMA-26-223-01 at https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01 and the CSAF file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json for vendor-confirmed fix versions and update instructions. As compensating controls pending a patch: restrict device use to private, physically controlled environments and avoid syncing or wearing the device in public spaces where an unknown actor within 10-30 meters could interact over BLE; these controls reduce exposure but do not eliminate the vulnerability and impair normal device usability. Healthcare providers and individuals in sensitive roles (domestic violence situations, protected populations) should be informed of the tracking risk posed by the static BLE address even when the device is not actively syncing.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today