Improper Authentication in Fire-Boltt Smartwatch FB BGS001

Publication date: 2026-07-07

Last updated on: 2026-07-09

Assigner: MITRE

Description

Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-09

Generated

2026-07-15

AI Q&A

2026-07-08

EPSS Evaluated

2026-07-14

NVD

CVE-2026-37271

EUVD

EUVD-2026-42155

Affected Vendors & Products

Vendor	Product	Version / Range
fire-boltt	smartwatch_fb_bgs001	2.0.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

The Fire-Boltt Smartwatch FB BGS001 Firmware version MOY-JS14-2.0.4 has a vulnerability related to improper authentication. Specifically, the device accepts GATT Write Request commands without requiring sufficient authentication or strong session validation. This means that under certain conditions, an attacker can replay previously captured Bluetooth Low Energy (BLE) packets from a nearby device to trigger functions on the smartwatch.

Impact Analysis

This vulnerability can allow an attacker to execute unauthorized commands on the smartwatch by replaying captured BLE packets. As a result, the attacker could potentially control or manipulate the device's functionality without proper authorization, leading to privacy breaches, unauthorized access, or misuse of the smartwatch features.

Hi! I’m here to help you understand CVE-2026-37271. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70