Vulnerability · Published Jan 11, 2026 · Assigned by VulDB
CVE-2026-0842Flycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication
Medium 6.3
In plain English
A medium-severity missing authentication in smART Sketcher from Flycatcher Toys. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetooth Low Energy Interface. This manipulation causes missing authentication. The attack can only be done within the local network. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Flycatcher Toys | smART Sketcher | 2.0 |
Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-340442 | Flycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication vdb-entry, technical-description
- VDB-340442 | CTI Indicators (IOB, IOC) signature, permissions-required
- Submit #729134 | Flycatcher Toys smART Sketcher 2.0 0/1/2 Missing Authentication for Critical Function third-party-advisory
- https://github.com/davidrxchester/smart-sketcher-upload/blob/main/smartsketch-upload.py exploit