CVE-2026-109571

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-306

Impact

Nearby attackers within Bluetooth range can monitor the wearer's real-time heart rate data. No authentication, pairing, bonding, or user interaction is required.

Root cause

The BLE GATT service lacks authentication requirements on the Heart Rate Measurement characteristic (0x2A37), allowing any adjacent device to subscribe to notifications.

Affected systems

Fire-Boltt BSW013 smartwatch firmware through V0.0.8

CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Check the vendor advisory or mobile app for firmware updates beyond V0.0.8; if no patch is available, keep Bluetooth disabled on the device or power it off in untrusted environments.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109571