CVE-2026-109571

Received Received - Intake

Missing Authentication in Fire-Boltt BSW013 Smartwatch Firmware

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109571

Affected Vendors & Products

Vendor	Product	Version / Range
Fire-Boltt	BSW013	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

The Fire-Boltt BSW013 smartwatch firmware through V0.0.8 has a missing authentication vulnerability. This flaw allows unpaired Bluetooth Low Energy (BLE) devices to subscribe to the Heart Rate Measurement characteristic (0x2A37) without requiring pairing, bonding, or user confirmation on the watch. Attackers within Bluetooth range can exploit this to receive the wearer's live heart rate data.

Detection Guidance

This vulnerability involves a missing authentication issue in the Fire-Boltt BSW013 smartwatch firmware. To detect it, monitor Bluetooth Low Energy (BLE) traffic for unauthorized subscriptions to the Heart Rate Measurement characteristic (0x2A37) without prior pairing. Use tools like Wireshark with BLE filters or hcitool to scan for unexpected BLE connections.

Impact Analysis

This vulnerability allows unauthorized individuals near the smartwatch to access the wearer's live heart rate readings without consent. This could lead to privacy invasion, unauthorized health data collection, or misuse of sensitive personal information.

Compliance Impact

This vulnerability may violate privacy regulations like GDPR and HIPAA by exposing sensitive health data without proper authorization. Organizations using this device could face compliance violations, legal penalties, and reputational damage due to unauthorized data access.

Mitigation Strategies

Update the smartwatch firmware to the latest version if available. Disable BLE discovery when not in use. Avoid using the smartwatch in public or untrusted areas. Consider disabling the Heart Rate Measurement characteristic if not needed.

Hi! I’m here to help you understand CVE-2026-109571. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70