CVE-2026-109570

Received Received - Intake

Missing Authentication in Fire-Boltt BSW013 Smartwatch Firmware

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC checksum to vibrate the watch and display spoofed alert text for phishing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109570

Affected Vendors & Products

Vendor	Product	Version / Range
Fire-Boltt	BSW013	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authentication flaw in Fire-Boltt BSW013 smartwatch firmware (V0.0.8). It allows unpaired attackers within Bluetooth range to inject fake notifications by exploiting a weak CRC-16/ARC checksum protection. Attackers can vibrate the watch and display spoofed alerts to potentially trick users.

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized BLE commands targeting the Fire-Boltt BSW013 smartwatch. Use Bluetooth sniffing tools like Wireshark with BLE filters to capture and inspect BLE traffic for proprietary command characteristics. Check for unexpected vibration alerts or spoofed notifications as potential indicators of exploitation.

Impact Analysis

This flaw could let attackers send phishing notifications to your smartwatch, tricking you into taking actions like clicking malicious links or revealing personal data. Since the watch vibrates and displays alerts, it may appear legitimate, increasing the risk of social engineering attacks.

Compliance Impact

The vulnerability allows attackers to inject spoofed notifications via Bluetooth, potentially tricking users into disclosing sensitive data. This could violate GDPR by compromising user privacy or HIPAA if health-related alerts are manipulated, leading to unauthorized data exposure.

Mitigation Strategies

Immediately update the smartwatch firmware to the latest version if available. Disable unnecessary Bluetooth services on the smartwatch when not in use. Implement physical access controls to prevent unauthorized proximity to the device. Monitor for suspicious BLE activity and disable the proprietary command characteristic if possible.

Hi! I’m here to help you understand CVE-2026-109570. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70