EUVD-2026-57006
GHSA-cxxh-6vq9-57gc
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
BLE-only adjacency constrains vector to AV:A; no attacker privileges needed; victim must run app (UI:R); scope changes to cloud system; high confidentiality via token capture, low integrity via data injection.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
2DescriptionCVE.org
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.
AnalysisAI
BLE peripheral spoofing in Mira Android companion app v4.5.15.4 allows an adjacent attacker to impersonate a Mira hormone analyzer by broadcasting a matching BLE advertisement name substring, bypassing all peripheral authentication. An attacker within Bluetooth range can intercept live session tokens from a victim's device and inject falsified hormone measurements directly into the victim's cloud health record and clinical trend views. Reported via CISA ICS Medical Advisory ICSMA-26-223-01; no public exploit code or CISA KEV listing is identified at time of analysis.
Technical ContextAI
The Mira system pairs a hardware hormone analyzer with an Android companion app (v4.5.15.4) over Bluetooth Low Energy (BLE). The app's peripheral identification logic relies exclusively on a substring match against the BLE advertisement name - a trivially spoofable, unauthenticated broadcast field. CWE-290 (Authentication Bypass by Spoofing) describes precisely this failure class: the application accepts a peripheral's identity claim without any verifiable cryptographic proof of that identity. Robust BLE implementations prevent rogue peripheral attacks using LE Secure Connections bonding, MAC address allowlisting, or out-of-band challenge/response mechanisms - none of which are present in v4.5.15.4. The CVSS 4.0 vector AV:A correctly reflects the Bluetooth adjacency constraint, and the SC:H metric captures that successful exploitation propagates falsified data into a downstream cloud health system beyond the mobile device itself.
RemediationAI
No vendor-released patched version number is identified in the available data; users must consult CISA ICS Medical Advisory ICSMA-26-223-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01) and the vendor directly for current patch availability and a fixed release version. Pending a patch, the most effective compensating control is to disable Bluetooth on the Android device entirely when not actively conducting a hormone measurement session, eliminating the BLE attack surface at the cost of requiring manual Bluetooth toggling before each use. Where Bluetooth must remain enabled, users should restrict app usage to private, controlled environments - avoiding pairing or scanning in clinics, waiting rooms, or any semi-public space where an attacker could plausibly be in BLE range. Healthcare providers managing patients using Mira devices should advise patients accordingly and monitor the CISA advisory channel for patch release notification. No network firewall or server-side control can mitigate this client-side BLE authentication failure.
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today