TCH QRing EUVD-2026-81275

Exploitation requires physical Bluetooth Low Energy proximity (roughly within ~10 meters) to a victim actively wearing a TCH QRing model R20_B006 running firmware RT09R20_1.00.00_250318, with the ring powered and advertising. The specific enabling condition is the device exposing the Nordic UART Service (NUS) with no client authentication or command authorization, so any BLE central can connect without pairing, bonding, or user approval and issue data-read commands. Limiting factors: the adjacent/proximity attack vector (not remotely reachable over the internet), the narrow single-model/single-firmware scope, and the need for the target to be within radio range while the ring is on - impact is confidentiality-only (health/biometric telemetry read), with no ability to modify device state or deny service described.

The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H, base 7.1) is internally consistent with the description: exploitation requires Bluetooth Low Energy proximity (Adjacent, not Network), no authentication (PR:N, matching CWE-306 Missing Authentication for Critical Function), and yields confidentiality-only impact (VC:H, VI:N/VA:N) - the attacker can read health telemetry but cannot alter device behavior or deny service per the described capabilities. There is no CISA KEV listing, no EPSS score, and no exploit-code flag in the input, so the exploitation signal is 'no public exploit identified at time of analysis'; however, two detailed reverse-engineering references (a blog post and a technical whitepaper from mrvar0x.com) document the exact technique, materially lowering the barrier to reproduction. The realistic risk is MODERATE and bounded: the AV:A proximity requirement means an attacker must be within BLE range (~10m) of a specific victim wearing this exact ring model/firmware, so this is a targeted physical-proximity privacy exposure rather than a mass-exploitable remote flaw. It is not a high-CVSS-but-hollow issue - the missing-authentication design flaw is real and the data (heart rate, blood oxygen, historical health records) is genuinely sensitive - but the adjacent attack vector and narrow product/firmware scope cap real-world priority well below a network-facing RCE.

An attacker within Bluetooth Low Energy range of a victim wearing a TCH QRing R20_B006 ring connects directly to the exposed Nordic UART Service without pairing, authentication, or user approval, bypassing the official app and cloud. They issue commands to read current battery and live heart rate, then retrieve stored historical heart rate and blood-oxygen records - a covert privacy/biometric leak. No packaged exploit is flagged in the input, but a public reverse-engineering whitepaper documents the full technique and command interface.