CVE-2026-109571: Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any nearby device within Bluetooth range can subscribe to the Heart Rate Measurement characteristic. The attacker does not need to pair or bond with the watch, authenticate, or obtain confirmation from the wearer.
What information can be exposed?
An attacker can receive the wearer’s live heart rate readings through the BLE Heart Rate Measurement characteristic (0x2A37). The provided information does not indicate exposure of other smartwatch data.
How can I determine whether a device is affected?
The issue affects Fire-Boltt BSW013 firmware through V0.0.8. Affected behavior is present if an unpaired BLE device can subscribe to characteristic 0x2A37 and receive heart-rate notifications without pairing, bonding, or watch-side confirmation.