EUVD-2026-81275
GHSA-2xqr-38g6-4hhr
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
BLE proximity gives AV:A; missing authentication on the UART service gives PR:N/AC:L; impact is limited to reading sensitive biometric data, so C:H with I:N/A:N.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service which enforces no client authentication or command authorization. Attackers within Bluetooth Low Energy range can connect directly to the ring, bypassing the official application and cloud authentication, to read battery levels, activate live heart rate monitoring, and retrieve stored historical heart rate and blood oxygen records.
AnalysisAI
Any attacker within Bluetooth Low Energy range can connect to a TCH QRing model R20_B006 smart ring running firmware RT09R20_1.00.00_250318 without pairing, authentication, or user approval, because the device exposes the Nordic UART Service with no client authentication or command authorization. From roughly 10 meters of a worn, powered ring, the attacker bypasses the official companion app and its cloud authentication to read battery status, activate live heart-rate monitoring, and pull stored historical heart-rate and blood-oxygen records. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires physical Bluetooth Low Energy proximity (roughly within ~10 meters) to a victim actively wearing a TCH QRing model R20_B006 running firmware RT09R20_1.00.00_250318, with the ring powered and advertising. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H, base 7.1) is internally consistent with the description: exploitation requires Bluetooth Low Energy proximity (Adjacent, not Network), no authentication (PR:N, matching CWE-306 Missing Authentication for Critical Function), and yields confidentiality-only impact (VC:H, VI:N/VA:N) - the attacker can read health telemetry but cannot alter device behavior or deny service per the described capabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, so the primary fix must come from TCH QRing in the form of firmware that either removes the Nordic UART Service from the advertising/attribute table or enforces LE Secure Connections pairing plus per-characteristic authorization before accepting data-read commands; contact the vendor and reference the researcher disclosure at https://mrvar0x.com/2026/05/19/reverse-engineering-hidden-capabilities-in-smart-ring-ecosystems/ to request a fixed firmware version and an advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every TCH QRing R20_B006 running firmware RT09R20_1.00.00_250318 and direct wearers to power the ring off or remove it whenever it is not actively syncing, because the device cannot be paired, authenticated, or access-controlled in its current state; suspend use in any clinical, patient-facing, or PHI-adjacent program until compensating controls are validated. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
CVE-2025-32879 is a security vulnerability (CVSS 8.8) that allows an attacker. Risk factors: public PoC available.
Heap OOB write in Android Bluetooth driver via incorrect bounds check.
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into usersp
Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire cred
Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to ac
Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 t
Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairi
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Rated medium severity (CVSS
Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2 may permit an adjacent
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today