EarVision Android Application EUVD-2026-75056

The attacker must be within adjacent wireless range (Bluetooth or Wi-Fi Direct proximity) of a victim who has the EarVision Android application running and paired to a C6 Ear Camera. The attacker must successfully spoof the wireless identity of the C6 Ear Camera device before the app initiates an update handshake, and must obtain exactly one user confirmation tap - the only gate between device spoofing and firmware delivery. Once that confirmation is received, the update channel applies no authentication check, no device certificate verification, and no firmware signature validation, so any binary payload is accepted. Exploitation cannot occur remotely over the internet and is bounded by the wireless radio range of the adjacent medium; no account credentials or prior access to the device or application are required.

The vendor-supplied CVSS 4.0 score of 8.5 (AV:A/AC:L/AT:N/PR:N/UI:A) correctly reflects the adjacent-network constraint and the single-interaction requirement, though the AT:N metric may understate practical attacker effort since device identity spoofing - while achievable with commodity tools - is a non-trivial prerequisite not captured by AC:L alone in CVSS 4.0 semantics. EPSS data is absent from available intelligence, and the vulnerability is not in CISA's KEV catalog, indicating no confirmed widespread in-the-wild exploitation. The realistic threat population is persons physically proximate to a victim actively running EarVision, which sharply limits opportunistic risk; even a mid-sized municipal IT team in kalisz deploying these devices for occupational health or audiology screenings should treat this as an urgent remediation given that a successful attack results in persistent firmware compromise of a body-adjacent sensing device. The most consequential outcome is arbitrary firmware implantation enabling covert audio or video capture from the ear canal during subsequent clinical use, making impact severity despite the niche product footprint non-trivial in healthcare environments.

An attacker in Bluetooth or Wi-Fi Direct range of a clinician running the EarVision app broadcasts a rogue wireless advertisement spoofing the C6 Ear Camera device identity. The victim is presented with a single confirmation dialog - appearing as a routine camera sync or update - which they tap to approve, triggering the application to push a malicious, unsigned firmware binary over the unauthenticated update channel, which is then flashed to the physical ear camera. The implanted firmware could enable covert microphone or camera activation during subsequent patient examinations.