CVE-2026-109570: Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC checksum to vibrate the watch and display spoofed alert text for phishing.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be within Bluetooth range of an affected Fire-Boltt BSW013 watch. The attacker does not need to be paired with the watch or authenticated.
What access or interaction is required?
No privileges or user interaction are required. The attacker needs BLE access to write crafted commands to the proprietary BLE command characteristic.
What could an attacker do?
An attacker can cause the watch to vibrate and display spoofed notification text, which could be used for phishing. The available information indicates integrity impact only; it does not indicate confidentiality or availability impact.
Does the CRC-16/ARC checksum prevent exploitation?
No. The command protection is described as only a CRC-16/ARC checksum, and crafted commands can still be used to inject notifications.