What is the CVSS score of EUVD-2026-42155?

EUVD-2026-42155 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Fire-Boltt Smartwatch are affected by EUVD-2026-42155?

Fire-Boltt FB BGS001 smartwatches (firmware MOY-JS14-2.0.4) contain a remote authentication bypass that affects all users of this model, though real-world exploitation likelihood remains minimal…

How to fix or mitigate EUVD-2026-42155?

24 hours: Identify and inventory all Fire-Boltt FB BGS001 devices in use across the organization. 7 days: Disable Bluetooth on affected devices when not in active use; isolate these devices from critical networks; notify device users of the vulnerability and interim protections. 30 days: Monitor Fire-Boltt security advisories for firmware patches (MOY-JS14-2.0.5 or later); develop a replacement timeline for devices used by high-risk users.

Fire-Boltt Smartwatch EUVD-2026-42155

| CVE-2026-37271 CRITICAL

Improper Authentication (CWE-287)

2026-07-07 mitre

GHSA-wjqj-v3q8-x4h3

Authentication Bypass N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

3.1 LOW

BLE proximity makes it AV:A not AV:N; requiring prior packet capture under specific conditions is AC:H; replaying writes is a limited integrity impact (I:L) with no confidentiality or availability effect.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 16:36 vuln.today

CVSS changed

Jul 09, 2026 - 16:22 NVD

9.8 (None) 9.8 (CRITICAL)

CVE Published

Jul 07, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.

AnalysisAI

Improper authentication in Fire-Boltt FB BGS001 smartwatch firmware MOY-JS14-2.0.4 lets a nearby attacker replay previously captured Bluetooth Low Energy (BLE) GATT Write Request packets to trigger device functionality without valid session validation. The device accepts write commands over BLE without sufficient authentication, so an attacker within radio range who has observed legitimate traffic can reissue those commands. A public technical writeup/PoC exists on GitHub (EmbdCDACHyd), but there is no evidence of active exploitation (SSVC Exploitation: none) and EPSS is low at 0.21% (11th percentile).

Technical ContextAI

The flaw is in the BLE GATT (Generic Attribute Profile) layer used by the smartwatch to receive commands from its companion mobile app. GATT Write Requests are the mechanism BLE peripherals use to accept configuration and control data on their characteristics. Here the peripheral does not bind writes to an authenticated, encrypted, freshness-protected session (no per-message nonce/counter or pairing-based link encryption), so it cannot distinguish a legitimate command from a byte-identical replay. This maps to CWE-287 (Improper Authentication): identity/session is never adequately verified before privileged actions execute. The CPE is unhelpful (cpe:2.3:a:n/a:n/a:*), so the only reliable product identifier is the description: Fire-Boltt FB BGS001, firmware build MOY-JS14-2.0.4 (a MediaTek/MOY-family wearable firmware string).

RemediationAI

No vendor-released patch version is identified at time of analysis; the referenced material (CDAC Hyderabad GitHub repo and PDF at https://github.com/EmbdCDACHyd/CVE/tree/main/CVE-2026-37271) is a research disclosure, not a fix. Monitor Fire-Boltt (http://fire-boltt.com) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-37271) for a firmware update superseding MOY-JS14-2.0.4 and apply it via the companion app once released. Compensating controls until then: keep the smartwatch unpaired/BLE disabled when not actively in use to deny attackers the window to capture and replay traffic (trade-off: disables notifications and app sync); avoid pairing or operating the device in untrusted crowded RF environments where a nearby attacker can sniff BLE (trade-off: inconvenience); and, if the companion app offers it, enable any BLE bonding/encryption or PIN pairing option (trade-off: may require re-pairing). Note these are mitigations only - they reduce opportunity but do not remove the missing session-validation flaw.