CVE-2026-66875

Received Received - Intake

Mira Hormone Monitor Firmware Remote Unauthenticated BLE Exploits

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: ICS-CERT

Description

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-66875

EUVD

EUVD-2026-57009

Affected Vendors & Products

Vendor	Product	Version / Range
mira	hormone_monitor_device	1.7.1.47

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Mira hormone monitor device firmware v1.7.1.47. A remote unauthenticated attacker within Bluetooth Low Energy (BLE) range can silently rebind the device to their own account without user knowledge. They can then extract stored hormone measurements in cleartext, cause a denial-of-service by sending malformed or undocumented BLE commands, and track the user passively due to a static random BLE address that does not change.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized BLE device bindings, static BLE addresses, and unusual hormone measurement data extraction. Use BLE scanning tools like hcitool or bluetoothctl to monitor nearby devices for static addresses and unexpected re-pairing attempts. Check device logs for malformed command opcodes or repeated connection attempts.

Impact Analysis

If you use the Mira hormone monitor device, an attacker within 10-30 meters could access your sensitive hormone data without your consent. They could also disrupt the device's functionality or track your movements over time due to the static BLE address.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal health data and HIPAA if the device is used in a covered healthcare context. It exposes sensitive health information without user consent, which is a direct violation of data protection requirements.

Mitigation Strategies

Immediately disable BLE connectivity on the Mira device if not in use. Update the firmware to the latest version if a patch is available. Restrict physical access to the device to prevent close-range attacks. Monitor network traffic for unauthorized data exfiltration attempts.

Hi! I’m here to help you understand CVE-2026-66875. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70