CVE-2026-109571 in BSW013
Summary
by MITRE • 10/13/2026
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The Fire-Boltt BSW013 smartwatch firmware version V0.0.8 and earlier exhibits a critical missing authentication vulnerability in its Bluetooth Low Energy implementation. This flaw specifically affects the Heart Rate Measurement characteristic, identified by the service UUID 0x2A37 within the standard Health Thermometer or Body Sensor Profile services commonly used in wearable devices. The security architecture fails to enforce an authorization check before allowing external clients to subscribe to notifications from this specific attribute. Consequently, any device capable of establishing a Bluetooth Low Energy connection can request and receive real-time physiological data without undergoing the necessary pairing or bonding procedures that are typically required for sensitive health information exchange.
From a technical perspective, the vulnerability stems from improper access control mechanisms within the BLE stack or the application layer firmware handling GATT characteristics. In secure implementations, subscribing to notifications on sensitive attributes like heart rate should require an established security context, often involving encryption and authentication keys derived during the pairing process. The absence of this check means that the characteristic is effectively exposed as publicly readable by any nearby Bluetooth scanner. An attacker does not need physical access or user interaction beyond being within radio range; they simply need to discover the service, identify the Heart Rate Measurement handle, and subscribe to its notifications stream.
The operational impact of this vulnerability is significant regarding personal privacy and data security. Attackers positioned within typical Bluetooth Low Energy range can passively collect live heart rate readings from a victim wearing the device. This capability allows for continuous monitoring without the wearer's knowledge or consent. Such unauthorized surveillance can be exploited for stalking, harassment, or gathering intelligence on an individual's physical state, location patterns based on activity levels, and potential health conditions inferred from resting heart rates. The lack of any confirmation prompt on the watch exacerbates the risk, as victims remain unaware that their biometric data is being exfiltrated in real time.
This vulnerability aligns with Common Weakness Enumeration CWE-287, which describes Improper Authentication, specifically where a system fails to verify identity before granting access to resources. It also maps to MITRE ATT&CK technique T1530, Data from Local System, as it involves the exfiltration of data directly from the victim's device via wireless communication channels like Bluetooth Low Energy. The attack vector is classified as local or adjacent network depending on proximity, but effectively allows remote exploitation within short-range limits without user interaction.
To mitigate this risk, users should immediately update their Fire-Boltt BSW013 firmware to a version that addresses the authentication gap if an official patch has been released by the manufacturer. If no patch is available, disabling Bluetooth when not in use can reduce exposure windows. For developers and manufacturers, remediation requires implementing strict access control lists on GATT characteristics containing sensitive personal data. Specifically, the Heart Rate Measurement characteristic must require a valid security context before allowing subscription requests. This involves verifying that the connection has been authenticated via pairing or bonding protocols defined by Bluetooth SIG specifications. Additionally, employing encryption for all BLE communications involving health metrics is essential to prevent eavesdropping even if authentication controls are bypassed through other means. Regular security audits and penetration testing of IoT firmware against common BLE attack vectors should be integrated into the development lifecycle to identify such oversights before product release.