Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck
CVE-2026-109571Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE
Medium 4.3
In plain English
A medium-severity missing authentication in BSW013 from Fire-Boltt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 92.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fire-Boltt | BSW013 | 0 – through V0.0.8 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- Researcher write-up and PoC technical-description, exploit
- VulnCheck Advisory: Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE third-party-advisory