Dashboard / CVE-2026-109571

CVE-2026-109571

LOW
INFO Priority: 0.00 BB Relevance: 50/100
Published: 2026-10-12 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: None
AT: Present
VC: Low
VI: None
VA: None

Description

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.

Weakness Classification (1)

References & Advisories (2)

Bug Bounty Relevance

50 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

2.3 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.18%
Raw Score 0.001770
Percentile 7.2%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00177
2026-10-28
0.00177

Intelligence Sources

mitre ref →
nvd ref →

External Links