Read the docs
TI-2026-71301 Aliases CVE-2026-109571GHSA-hj6p-cc45-4m6g

Missing authentication in Fire-Boltt BSW013 leaks heart rate over BLE

Priority LOW 11CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 is affected. Missing authentication (CWE-306) lets unpaired Bluetooth Low Energy devices subscribe to the Heart Rate Measurement characteristic. An attacker within Bluetooth range can receive the wearer's live heart rate readings without pairing or any confirmation on the watch. The references link a public exploit.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00177 7th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Fire-BolttBSW013up to V0.0.8—No fix listedCNA
  • BSW013 VendorFire-Boltt Affected up to V0.0.8 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Fire-Boltt BSW013.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109571
  2. 2026-10-13 Alias added: GHSA-hj6p-cc45-4m6g
  3. 2026-10-26 CISA SSVC decision points changed

References

Exploit 1

  • TI-2026-71300 Fire-Boltt BSW013 smartwatch accepts unauthenticated BLE alerts CVSS 4.0MEDIUM 5.3
  • TI-2024-20346 An issue in Fireboltt Dream Wristphone BSW202_FB_AAC_v2.0_20240110-20240110-1956 allows… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences