CVE-2026-89034 in QRing
Summary
by MITRE • 09/17/2026
TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service which enforces no client authentication or command authorization. Attackers within Bluetooth Low Energy range can connect directly to the ring, bypassing the official application and cloud authentication, to read battery levels, activate live heart rate monitoring, and retrieve stored historical heart rate and blood oxygen records.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The TCH QRing smart ring model R20_B006 operating on firmware version RT09R20_1.00.00_250318 exhibits a critical security flaw rooted in the improper implementation of Bluetooth Low Energy authentication protocols. This vulnerability allows any attacker within proximity to establish an unauthenticated connection with the device, completely bypassing standard pairing requirements and user approval mechanisms. The root cause lies in the configuration of the exposed Nordic UART Service, which is designed for data transmission but fails to enforce client-side authentication or command authorization checks. By exploiting this misconfiguration, adversaries can interact directly with the ring’s internal services without needing credentials or prior trust relationships, effectively rendering the device's security perimeter non-existent at the transport layer.
From a technical perspective, the flaw represents a classic case of insecure direct object references combined with broken access control within an IoT ecosystem. The Nordic UART Service is typically used for serial communication over BLE, but in this implementation, it operates without any encryption or authentication handshake procedures that are standard for sensitive health data devices. This oversight allows attackers to send commands and receive responses as if they were the legitimate companion application. Consequently, the device exposes its internal state and stored datasets to unauthorized entities simply by being within Bluetooth range, which is typically up to ten meters in typical indoor environments.
The operational impact of this vulnerability is severe due to the sensitive nature of the data accessible through these unauthenticated channels. Attackers can retrieve real-time biometric information including current battery levels, live heart rate monitoring data, and historical records of both heart rate and blood oxygen saturation (SpO2). This exposure violates user privacy expectations and poses significant risks for identity theft or stalking if such detailed physiological patterns are harvested over time. Furthermore, the ability to activate live monitoring without consent constitutes a direct intrusion into personal space, potentially causing psychological distress or enabling malicious actors to track an individual's location based on their physical activity levels derived from heart rate data.
This vulnerability aligns with several established industry standards and threat models. It is classified under CWE-287 Improper Authentication, as the device fails to verify the identity of connecting clients before granting access to protected resources. Additionally, it falls under CWE-319 Cleartext Transmission of Sensitive Information if any data exchanged over this unauthenticated link is not encrypted, although even without encryption, the mere ability to read sensitive health metrics constitutes a privacy breach. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1046 Network Service Discovery, where attackers enumerate and exploit services on connected devices, specifically leveraging BLE enumeration capabilities common in mobile operating systems.
Mitigation strategies must address both the immediate technical flaw and broader architectural weaknesses. The primary remediation involves modifying the firmware of the Nordic UART Service to enforce strict authentication requirements before allowing any data exchange or command execution. This should include implementing mutual authentication protocols where the ring verifies the identity of the connecting device against a whitelist of trusted companion applications. Additionally, enabling encryption for all BLE communications is essential to prevent eavesdropping even if an attacker manages to bypass initial access controls temporarily. Manufacturers should also consider disabling unnecessary services like Nordic UART in production builds unless explicitly required by specific use cases that have undergone rigorous security review. Users affected by this vulnerability are advised to keep their devices updated with any patches released by the manufacturer and to disable Bluetooth connectivity when not actively using the device for health monitoring purposes, thereby reducing the attack surface available to nearby adversaries.