CVE-2026-121818: About Time Technologies｜Herowatch Go - Security Misconfiguration
Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Replace About Time Technologies Herowatch Mini (Herowatch Go) with a supported device because the product is no longer maintained.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated local access to the affected device. The provided information does not indicate that remote, unauthenticated exploitation is possible.
What does successful exploitation allow?
An attacker can use the publicly available test key to sign malicious programs. This can allow privilege escalation and arbitrary code execution with high impact to confidentiality, integrity, and availability.
How can defenders determine whether they are affected?
The issue is described for Herowatch Mini developed by About Time Technologies. The provided information does not include affected versions, configuration checks, or detection indicators.