CVE-2026-109570 in BSW013
Summary
by MITRE • 10/13/2026
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC checksum to vibrate the watch and display spoofed alert text for phishing.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The Fire-Boltt BSW013 smartwatch, specifically in firmware versions through V0.0.8, suffers from a critical missing authentication vulnerability within its Bluetooth Low Energy (BLE) communication protocol. This flaw stems from the device's failure to enforce strict access control mechanisms on specific proprietary command characteristics exposed via BLE services. In secure IoT and wearable designs, commands that alter user experience or system state should require prior pairing and cryptographic verification of identity. However, in this implementation, any client within Bluetooth range can interact with these endpoints without establishing a trusted relationship with the host device. This architectural oversight effectively treats unauthenticated devices as peers, allowing malicious actors to send arbitrary instructions directly to the watch’s firmware logic.
The technical mechanism exploited involves writing data to specific BLE characteristics that control notification display and haptic feedback systems. The security controls in place are insufficiently robust; they rely solely on a CRC-16/ARC checksum for integrity verification rather than authentication or encryption. A cyclic redundancy check ensures that the transmitted packet has not been corrupted during transmission, but it provides no guarantee regarding the origin of the data. Consequently, an attacker can craft valid BLE packets containing malicious commands that pass this basic integrity check because they calculate the correct CRC value locally before sending. This allows the injection of arbitrary payloads into the notification queue without triggering any rejection or security alert from the watch’s operating system.
The operational impact of this vulnerability is significant due to its potential for social engineering and phishing attacks. An attacker within proximity can force the smartwatch to vibrate, drawing immediate attention from the user. Simultaneously, the device displays spoofed notification text crafted by the attacker. These notifications can mimic legitimate alerts from banking applications, email services, or system updates, creating a sense of urgency or curiosity that prompts the user to interact with their paired smartphone. This interaction serves as a vector for phishing campaigns where users might be tricked into visiting malicious websites or entering credentials on fraudulent login pages presented via QR codes or links within the spoofed notifications. The trust placed in wearable devices amplifies this risk, as users often perceive alerts from such personal gadgets as highly credible and immediate.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, specifically regarding the failure to verify identity before granting access to sensitive functions. It also relates to CWE-345, Insufficient Verification of Data Authenticity, as the reliance on CRC checksums fails to provide genuine data origin authentication. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1078, Valid Accounts or Legitimate Credentials, although in this case it is more accurately described as exploiting a lack of access control rather than stealing credentials. It also touches upon T1539, Steal Web Session Cookie, if the phishing leads to session hijacking on connected devices.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is for Fire-Boltt to release a firmware update that enforces mandatory BLE pairing before allowing write access to notification or haptic control characteristics. This should involve implementing mutual authentication protocols, such as using signed commands with shared secrets established during the initial pairing process. Additionally, developers should avoid relying solely on checksums like CRC-16 for security-critical operations; instead, they must employ cryptographic message authentication codes (HMAC) to ensure both integrity and authenticity of incoming data. For users currently affected by this vulnerability, it is advisable to keep Bluetooth disabled when not actively using the device or to disable notification mirroring features if available in settings until a patch is deployed. Security researchers should also monitor for subsequent firmware versions that may address these gaps through enhanced encryption standards like AES-CCM used in modern BLE secure connections.