Mira Firmware
Monthly
Authentication bypass in the Mira fertility-tracking cloud API allows any remote attacker to take over user accounts by supplying only a victim's email address and an arbitrary password, since the login endpoint validates the email but accepts any format-valid string as the password and returns a live active session token. Affecting Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 (Quanovate Tech Inc, operating as Mira / Mira Care), this reported by CISA (ICSMA-26-223-01) carries a CVSS 4.0 base score of 9.3 and exposes sensitive reproductive-health (hormone) records and account settings. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Brute-force credential attacks against Mira's cloud authentication endpoints are unrestricted due to the complete absence of per-account rate limiting, per-IP throttling, and account lockout controls, as disclosed in CISA ICS Medical Advisory ICSMA-26-223-01. Affected products include Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 from Quanovate Tech Inc. (operating as Mira / Mira Care), a healthcare-focused IoT platform. An unauthenticated remote attacker can systematically enumerate credentials at arbitrary scale to gain unauthorized access to user accounts, with no public exploit code or CISA KEV listing identified at time of analysis.
Firmware version spoofing in the Mira cloud API allows authenticated users to submit arbitrary firmware version strings for their own registered devices, bypassing server-side validation entirely. Affected products are Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 by Quanovate Tech Inc., operating in a medical IoT context and reported under CISA ICS-CERT advisory ICSMA-26-223-01. An attacker exploiting this flaw can cause the vendor backend to misrecord their device's patch state, suppressing security update prompts and distorting fleet-wide vulnerability analytics - with no public exploit identified at time of analysis.
Session token exposure in the Mira Android app (Quanovate Tech Inc.) leaks live authentication credentials to third-party web properties and referrer logs whenever users trigger in-app WebView flows such as shop redirects. The app appends the active session token as a URL query string parameter and embeds a persistent user identifier in the WebView User-Agent header, both of which are transmitted to any destination or JavaScript context receiving that traffic. Reported by ICS-CERT under medical advisory ICSMA-26-223-01, this vulnerability affects a healthcare-adjacent platform, amplifying the sensitivity of exposed credentials; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the Mira fertility-tracking cloud API allows any remote attacker to take over user accounts by supplying only a victim's email address and an arbitrary password, since the login endpoint validates the email but accepts any format-valid string as the password and returns a live active session token. Affecting Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 (Quanovate Tech Inc, operating as Mira / Mira Care), this reported by CISA (ICSMA-26-223-01) carries a CVSS 4.0 base score of 9.3 and exposes sensitive reproductive-health (hormone) records and account settings. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Brute-force credential attacks against Mira's cloud authentication endpoints are unrestricted due to the complete absence of per-account rate limiting, per-IP throttling, and account lockout controls, as disclosed in CISA ICS Medical Advisory ICSMA-26-223-01. Affected products include Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 from Quanovate Tech Inc. (operating as Mira / Mira Care), a healthcare-focused IoT platform. An unauthenticated remote attacker can systematically enumerate credentials at arbitrary scale to gain unauthorized access to user accounts, with no public exploit code or CISA KEV listing identified at time of analysis.
Firmware version spoofing in the Mira cloud API allows authenticated users to submit arbitrary firmware version strings for their own registered devices, bypassing server-side validation entirely. Affected products are Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 by Quanovate Tech Inc., operating in a medical IoT context and reported under CISA ICS-CERT advisory ICSMA-26-223-01. An attacker exploiting this flaw can cause the vendor backend to misrecord their device's patch state, suppressing security update prompts and distorting fleet-wide vulnerability analytics - with no public exploit identified at time of analysis.
Session token exposure in the Mira Android app (Quanovate Tech Inc.) leaks live authentication credentials to third-party web properties and referrer logs whenever users trigger in-app WebView flows such as shop redirects. The app appends the active session token as a URL query string parameter and embeds a persistent user identifier in the WebView User-Agent header, both of which are transmitted to any destination or JavaScript context receiving that traffic. Reported by ICS-CERT under medical advisory ICSMA-26-223-01, this vulnerability affects a healthcare-adjacent platform, amplifying the sensitivity of exposed credentials; no public exploit code or CISA KEV listing has been identified at time of analysis.