TI-2026-84975 Aliases CVE-2026-121818 GHSA-54r8-946x-g5g5

Public test signing key in Herowatch Go enables privilege escalation

LOW 38CWE-1394Published 2026-11-04 · Updated 2026-11-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

About Time Technologies Herowatch Go is affected in all versions. A publicly available test key used for system signing lets authenticated local attackers sign malicious programs (CWE-1394). Successful exploitation allows privilege elevation and arbitrary code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00129 2nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
About Time Technologies	Herowatch Go	all	—	No fix listed	CNA

Herowatch Go VendorAbout Time Technologies Affected all Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Herowatch Go.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

2026-11-04 Threatist record created from CVE-2026-121818
2026-11-04 Affected versions changed · CNA
2026-11-04 Alias added: GHSA-54r8-946x-g5g5
2026-11-04 CISA SSVC decision points changed
2026-11-04 Priority changed: MEDIUM → LOW

References

Advisory 2

TI-2026-84973 Missing authentication in Herowatch Mini exposes ADB shell CVSS 4.0HIGH 8.7
TI-2026-84974 Insecure direct object reference in About Time Herowatch Go Server CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences